Splunk Search

How to increase elastic search timeout?

ahmadsaadwarrai
Explorer

Sometimes my search gets fail and unable to fetch data because of below error:

ConnectionTimeout at "/opt/splunk/etc/apps/elasticsplunk/bin/elasticsearch/connection/http_urllib3.py", line 155 : ConnectionTimeout caused by - ReadTimeoutError(HTTPConnectionPool(host=u'172.16.9.xx', port=9200): Read timed out. (read timeout=10))
[indexer1.dr] ConnectionTimeout at "/opt/splunk/var/run/searchpeers/search1.dr-1561073970/apps/elasticsplunk/bin/elasticsearch/connection/http_urllib3.py", line 155 : ConnectionTimeout caused by - ReadTimeoutError(HTTPConnectionPool(host=u'172.16.9.xx', port=9200): Read timed out. (read timeout=10))
[indexer2.dr] ConnectionTimeout at "/opt/splunk/var/run/searchpeers/search1.dr-1561073970/apps/elasticsplunk/bin/elasticsearch/connection/http_urllib3.py", line 155 : ConnectionTimeout caused by - ReadTimeoutError(HTTPConnectionPool(host=u'172.16.9.xx', port=9200): Read timed out. (read timeout=10))

Does anyone know how to fine tune or increase this timeout settings?

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi ahmadsaadwarraich,

reading the error messages the error is caused by your search peers which indicates that this search command you are using is distributed to the search peers. Usually this is fine, but in this special case the command should only be executed on the search head. This can be configured in the commands.conf for this app by setting the option local = true

local = [true|false]
* If true, specifies that the command should be run on the search head only
* Defaults to false

If you're still hitting timeout issues head over to the offical elastic search GitHub repo https://github.com/elastic/elasticsearch-py/blob/master/elasticsearch/connection/http_urllib3.py and check how the timeout is handled which is 10 seconds by default btw.

Hope this helps ...

cheers, MuS

View solution in original post

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi ahmadsaadwarraich,

reading the error messages the error is caused by your search peers which indicates that this search command you are using is distributed to the search peers. Usually this is fine, but in this special case the command should only be executed on the search head. This can be configured in the commands.conf for this app by setting the option local = true

local = [true|false]
* If true, specifies that the command should be run on the search head only
* Defaults to false

If you're still hitting timeout issues head over to the offical elastic search GitHub repo https://github.com/elastic/elasticsearch-py/blob/master/elasticsearch/connection/http_urllib3.py and check how the timeout is handled which is 10 seconds by default btw.

Hope this helps ...

cheers, MuS

0 Karma

ahmadsaadwarrai
Explorer

Thanks MuS, I have updated the http_urllib3.py script by myself and changed timeout from 10s to 30s.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi there, I have removed the last octet of the IP's.

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...