I am trying to setup the DUO Splunk Connector and am getting the following error in Splunk Web upon submitting the configuration form:
Encountered the following error while trying to save: Splunkd daemon is not responding: ("Error connecting to /servicesNS/admin/duo_splunkapp/data/inputs/duo_input: ('The read operation timed out',)",)
I have verified my Key and Host settings.
Splunkd.log:
01-11-2018 09:32:31.789 -0700 INFO ModularInputs - <stderr> Argument validation for scheme=duo_input: Validating input
01-11-2018 09:33:01.751 -0700 ERROR ModularInputs - Argument validation for scheme=duo_input: killing process, because executing it took too long (over 30000 msecs).
01-11-2018 09:33:01.753 -0700 INFO ModularInputs - Argument validation for scheme=duo_input: script running failed (killed by signal 9: Killed).
01-11-2018 09:33:01.754 -0700 WARN HttpListener - Socket error from 127.0.0.1 while accessing /servicesNS/admin/duo_splunkapp/data/inputs/duo_input: Broken pipe
I believe that I need to raise a timeout setting, but my searches have turned up null when looking for any sort of timeout setting that the Splunk REST API references.
Hi folks,
In this particular case I had to edit:
/opt/splunk/etc/system/local/web.conf
adding the stanza:
splunkdConnectionTimeout = 120
which is defaulted to 30 seconds
Hi folks,
In this particular case I had to edit:
/opt/splunk/etc/system/local/web.conf
adding the stanza:
splunkdConnectionTimeout = 120
which is defaulted to 30 seconds
I set this to 120 and verified it with this rest:
| rest /servicesNS/-/-/configs/conf-web/settings
after restarting splunkweb. however, I get the same message in ~/var/log/splunk/splunkd.log which is that it got killed after 30000 msecs (30 seconds).
Did you restart splunkd (i.e. not just splunkweb)?
Yes, I did. Also I verified the settings using the rest you show above.
|REST timeout=33333 (in seconds)
In what configuration file?
I ran:
find /opt/splunk/ -name "*.conf" -print | xargs grep "REST timeout"
and
grep -rnw '/opt/splunk/' -e 'REST timeout'
And didn't find it.