Splunk Search

How to increase elastic search timeout?

ahmadsaadwarrai
Explorer

Sometimes my search gets fail and unable to fetch data because of below error:

ConnectionTimeout at "/opt/splunk/etc/apps/elasticsplunk/bin/elasticsearch/connection/http_urllib3.py", line 155 : ConnectionTimeout caused by - ReadTimeoutError(HTTPConnectionPool(host=u'172.16.9.xx', port=9200): Read timed out. (read timeout=10))
[indexer1.dr] ConnectionTimeout at "/opt/splunk/var/run/searchpeers/search1.dr-1561073970/apps/elasticsplunk/bin/elasticsearch/connection/http_urllib3.py", line 155 : ConnectionTimeout caused by - ReadTimeoutError(HTTPConnectionPool(host=u'172.16.9.xx', port=9200): Read timed out. (read timeout=10))
[indexer2.dr] ConnectionTimeout at "/opt/splunk/var/run/searchpeers/search1.dr-1561073970/apps/elasticsplunk/bin/elasticsearch/connection/http_urllib3.py", line 155 : ConnectionTimeout caused by - ReadTimeoutError(HTTPConnectionPool(host=u'172.16.9.xx', port=9200): Read timed out. (read timeout=10))

Does anyone know how to fine tune or increase this timeout settings?

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi ahmadsaadwarraich,

reading the error messages the error is caused by your search peers which indicates that this search command you are using is distributed to the search peers. Usually this is fine, but in this special case the command should only be executed on the search head. This can be configured in the commands.conf for this app by setting the option local = true

local = [true|false]
* If true, specifies that the command should be run on the search head only
* Defaults to false

If you're still hitting timeout issues head over to the offical elastic search GitHub repo https://github.com/elastic/elasticsearch-py/blob/master/elasticsearch/connection/http_urllib3.py and check how the timeout is handled which is 10 seconds by default btw.

Hope this helps ...

cheers, MuS

View solution in original post

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi ahmadsaadwarraich,

reading the error messages the error is caused by your search peers which indicates that this search command you are using is distributed to the search peers. Usually this is fine, but in this special case the command should only be executed on the search head. This can be configured in the commands.conf for this app by setting the option local = true

local = [true|false]
* If true, specifies that the command should be run on the search head only
* Defaults to false

If you're still hitting timeout issues head over to the offical elastic search GitHub repo https://github.com/elastic/elasticsearch-py/blob/master/elasticsearch/connection/http_urllib3.py and check how the timeout is handled which is 10 seconds by default btw.

Hope this helps ...

cheers, MuS

0 Karma

ahmadsaadwarrai
Explorer

Thanks MuS, I have updated the http_urllib3.py script by myself and changed timeout from 10s to 30s.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi there, I have removed the last octet of the IP's.

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...