Splunk Search

How to increase elastic search timeout?

ahmadsaadwarrai
Explorer

Sometimes my search gets fail and unable to fetch data because of below error:

ConnectionTimeout at "/opt/splunk/etc/apps/elasticsplunk/bin/elasticsearch/connection/http_urllib3.py", line 155 : ConnectionTimeout caused by - ReadTimeoutError(HTTPConnectionPool(host=u'172.16.9.xx', port=9200): Read timed out. (read timeout=10))
[indexer1.dr] ConnectionTimeout at "/opt/splunk/var/run/searchpeers/search1.dr-1561073970/apps/elasticsplunk/bin/elasticsearch/connection/http_urllib3.py", line 155 : ConnectionTimeout caused by - ReadTimeoutError(HTTPConnectionPool(host=u'172.16.9.xx', port=9200): Read timed out. (read timeout=10))
[indexer2.dr] ConnectionTimeout at "/opt/splunk/var/run/searchpeers/search1.dr-1561073970/apps/elasticsplunk/bin/elasticsearch/connection/http_urllib3.py", line 155 : ConnectionTimeout caused by - ReadTimeoutError(HTTPConnectionPool(host=u'172.16.9.xx', port=9200): Read timed out. (read timeout=10))

Does anyone know how to fine tune or increase this timeout settings?

0 Karma
1 Solution

MuS
Legend

Hi ahmadsaadwarraich,

reading the error messages the error is caused by your search peers which indicates that this search command you are using is distributed to the search peers. Usually this is fine, but in this special case the command should only be executed on the search head. This can be configured in the commands.conf for this app by setting the option local = true

local = [true|false]
* If true, specifies that the command should be run on the search head only
* Defaults to false

If you're still hitting timeout issues head over to the offical elastic search GitHub repo https://github.com/elastic/elasticsearch-py/blob/master/elasticsearch/connection/http_urllib3.py and check how the timeout is handled which is 10 seconds by default btw.

Hope this helps ...

cheers, MuS

View solution in original post

0 Karma

MuS
Legend

Hi ahmadsaadwarraich,

reading the error messages the error is caused by your search peers which indicates that this search command you are using is distributed to the search peers. Usually this is fine, but in this special case the command should only be executed on the search head. This can be configured in the commands.conf for this app by setting the option local = true

local = [true|false]
* If true, specifies that the command should be run on the search head only
* Defaults to false

If you're still hitting timeout issues head over to the offical elastic search GitHub repo https://github.com/elastic/elasticsearch-py/blob/master/elasticsearch/connection/http_urllib3.py and check how the timeout is handled which is 10 seconds by default btw.

Hope this helps ...

cheers, MuS

0 Karma

ahmadsaadwarrai
Explorer

Thanks MuS, I have updated the http_urllib3.py script by myself and changed timeout from 10s to 30s.

0 Karma

MuS
Legend

Hi there, I have removed the last octet of the IP's.

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...