Splunk Search

How do I change the REST API execution timeout?

thelucas
Explorer

I am trying to setup the DUO Splunk Connector and am getting the following error in Splunk Web upon submitting the configuration form:

Encountered the following error while trying to save: Splunkd daemon is not responding: ("Error connecting to /servicesNS/admin/duo_splunkapp/data/inputs/duo_input: ('The read operation timed out',)",)

I have verified my Key and Host settings.

Splunkd.log:

01-11-2018 09:32:31.789 -0700 INFO  ModularInputs - <stderr> Argument validation for scheme=duo_input:  Validating input
01-11-2018 09:33:01.751 -0700 ERROR ModularInputs - Argument validation for scheme=duo_input: killing process, because executing it took too long (over 30000 msecs).
01-11-2018 09:33:01.753 -0700 INFO  ModularInputs - Argument validation for scheme=duo_input: script running failed (killed by signal 9: Killed).
01-11-2018 09:33:01.754 -0700 WARN  HttpListener - Socket error from 127.0.0.1 while accessing /servicesNS/admin/duo_splunkapp/data/inputs/duo_input: Broken pipe

I believe that I need to raise a timeout setting, but my searches have turned up null when looking for any sort of timeout setting that the Splunk REST API references.

Tags (1)
0 Karma
1 Solution

thelucas
Explorer

Hi folks,

In this particular case I had to edit:
/opt/splunk/etc/system/local/web.conf

adding the stanza:

splunkdConnectionTimeout = 120

which is defaulted to 30 seconds

View solution in original post

thelucas
Explorer

Hi folks,

In this particular case I had to edit:
/opt/splunk/etc/system/local/web.conf

adding the stanza:

splunkdConnectionTimeout = 120

which is defaulted to 30 seconds

wrangler2x
Motivator

I set this to 120 and verified it with this rest:

| rest /servicesNS/-/-/configs/conf-web/settings

after restarting splunkweb. however, I get the same message in ~/var/log/splunk/splunkd.log which is that it got killed after 30000 msecs (30 seconds).

0 Karma

thelucas
Explorer

Did you restart splunkd (i.e. not just splunkweb)?

0 Karma

wrangler2x
Motivator

Yes, I did. Also I verified the settings using the rest you show above.

0 Karma

valiquet
Contributor
|REST timeout=33333 (in seconds)

thelucas
Explorer

In what configuration file?

I ran:

find /opt/splunk/ -name "*.conf" -print | xargs grep "REST timeout"

and

grep -rnw '/opt/splunk/' -e 'REST timeout'

And didn't find it.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...