How do I change the REST API execution timeout?

[thelucas]

I am trying to setup the DUO Splunk Connector and am getting the following error in Splunk Web upon submitting the configuration form:

Encountered the following error while trying to save: Splunkd daemon is not responding: ("Error connecting to /servicesNS/admin/duo_splunkapp/data/inputs/duo_input: ('The read operation timed out',)",)

I have verified my Key and Host settings.

Splunkd.log:

01-11-2018 09:32:31.789 -0700 INFO  ModularInputs - <stderr> Argument validation for scheme=duo_input:  Validating input
01-11-2018 09:33:01.751 -0700 ERROR ModularInputs - Argument validation for scheme=duo_input: killing process, because executing it took too long (over 30000 msecs).
01-11-2018 09:33:01.753 -0700 INFO  ModularInputs - Argument validation for scheme=duo_input: script running failed (killed by signal 9: Killed).
01-11-2018 09:33:01.754 -0700 WARN  HttpListener - Socket error from 127.0.0.1 while accessing /servicesNS/admin/duo_splunkapp/data/inputs/duo_input: Broken pipe

I believe that I need to raise a timeout setting, but my searches have turned up null when looking for any sort of timeout setting that the Splunk REST API references.

[thelucas · Accepted solution]

Hi folks,

In this particular case I had to edit:
/opt/splunk/etc/system/local/web.conf

adding the stanza:

splunkdConnectionTimeout = 120

which is defaulted to 30 seconds

[wrangler2x]

I set this to 120 and verified it with this rest:

| rest /servicesNS/-/-/configs/conf-web/settings

after restarting splunkweb. however, I get the same message in ~/var/log/splunk/splunkd.log which is that it got killed after 30000 msecs (30 seconds).

[thelucas]

Did you restart splunkd (i.e. not just splunkweb)?

[wrangler2x]

Yes, I did. Also I verified the settings using the rest you show above.

[valiquet]

|REST timeout=33333 (in seconds)

[thelucas]

In what configuration file?

I ran:

find /opt/splunk/ -name "*.conf" -print | xargs grep "REST timeout"

and

grep -rnw '/opt/splunk/' -e 'REST timeout'

And didn't find it.

[valiquet]

https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Rest