Splunk Observability Cloud

Frequent http 400 responses to SignalFlow client

JohnGregg
Path Finder

I am using the Java SignalFlow client to send the same query each minute.  Only the start and end times change.  I actually set the start and end time to the same value, which seems to reliably give me a single data point, which is what I want.

"persistent" is false and "immediate" is true.

I'm reusing the SignalFlowClient object but closing the computation after reading the results.

If I run the client in a loop with a 60 second delay between iterations, I get frequent but unpredictable http 400 bad request responses.  It appears the first request always succeeds.  There is no further info about what's bad.  Output looks like this:

com.signalfx.signalflow.client.SignalFlowException: 400: failed post [ POST https://stream.us0.signalfx.com:443/v2/signalflow/execute?start=1750889822602&stop=1750889822602&persistent=false&immediate=true&timezone=America%2FChicago HTTP/1.1 ] reason: Bad Request
at com.signalfx.signalflow.client.ServerSentEventsTransport$TransportConnection.post(ServerSentEventsTransport.java:338)
at com.signalfx.signalflow.client.ServerSentEventsTransport.execute(ServerSentEventsTransport.java:106)
at com.signalfx.signalflow.client.Computation.execute(Computation.java:185)
at com.signalfx.signalflow.client.Computation.<init>(Computation.java:67)
at com.signalfx.signalflow.client.SignalFlowClient.execute(SignalFlowClient.java:145)

 How can I troubleshoot this further?  I can't find much useful info about how the client is supposed to work.

thanks

 

Labels (1)
0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @JohnGregg 

I believe the 400 bad request is being caused by the specific params being sent, Are you able to print any logging to see what the start/end time is being requested? If there is an issue where the start time > now(), start_time = end_time, start_time > end_time or some other invalid timing then it could cause the issue - If you're running in a loop like this then it can be easy to get into these problems without realising.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

JohnGregg
Path Finder

Thanks.  I'm thinking it might have been a time sync issue.  If I set the start time slightly in the past, like even 1 second, it works.

What I've settled on is setting the start time on the minute (no seconds) with the same value for the end time.  That seems to return the single record that I want.

thanks

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...