Splunk Search

Read error when exporting to CSV file

deca2499
Engager

Hey all,

I hope this is the correct board for this question, but I am having an issue when I try to export a search to CSV from a search. I keep getting the following error when trying to run the export. Has anyone seen this and how to resolve it? I am using version 8.1.2 FWIW.

Unrecoverable error in the server.
Traceback (most recent call last):
  File "C:\Program Files\Splunk\Python-3.7\lib\site-packages\cherrypy\_cpwsgi.py", line 184, in trap
    return func(*args, **kwargs)
  File "C:\Program Files\Splunk\Python-3.7\lib\site-packages\cherrypy\_cpwsgi.py", line 277, in __next__
    return next(self.iter_response)
  File "C:\Program Files\Splunk\Python-3.7\lib\site-packages\cherrypy\lib\encoding.py", line 99, in encoder
    for chunk in body:
  File "C:\Program Files\Splunk\Python-3.7\lib\site-packages\splunk\rest\__init__.py", line 698, in readall
    data = response.read(blocksize)
  File "C:\Program Files\Splunk\Python-3.7\lib\http\client.py", line 457, in read
    n = self.readinto(b)
  File "C:\Program Files\Splunk\Python-3.7\lib\http\client.py", line 501, in readinto
    n = self.fp.readinto(b)
  File "C:\Program Files\Splunk\Python-3.7\lib\socket.py", line 589, in readinto
    return self._sock.recv_into(b)
  File "C:\Program Files\Splunk\Python-3.7\lib\ssl.py", line 1071, in recv_into
    return self.read(nbytes, buffer)
  File "C:\Program Files\Splunk\Python-3.7\lib\ssl.py", line 929, in read
    return self._sslobj.read(len, buffer)
socket.timeout: The read operation timed out

THanks!

 

Labels (1)
Tags (2)
0 Karma

linuxchuck
Explorer

Hi @deca2499 

I ran into this same problem just this morning. I've since figured out how to resolve the issue:

Update the following setting in web.conf on your search head:

splunkdConnectionTimeout

I set mine to 180, and was finally able to export large result sets.

 

Hope this helps!

Tags (1)

BrendanCO
Path Finder

I know I'm chiming in late on this one, but when I change splunkdConnection to 180 (./var/run/splunk/merged/web.conf) it resets back to 30 after restarting splunk. 

 

Is that the correct web.conf?

 

0 Karma

scelikok
SplunkTrust
SplunkTrust

hi @BrendanCO,

Correct web.conf is at $SPLUNK_HOME/etc/system/local/web.conf

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

Bhupal
Engager

This worked. Thank you.

0 Karma

osunjio
New Member

Hi Deca,

How long does the search for 14k result take  and how long does that for 24 hrs take ?  When you export report to csv from UI, you have this message on the lower part of the dialogue box  "Your search will rerun if the number of results is higher than 1,000". So my guess is that the 24 hours is taking to much time to run- beyond the timeout setting.

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @deca2499,

How big is your result? Do you get the same error even the result is a few small events? 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

deca2499
Engager

Hi @scelikok ,

I was just able to get the export done with 14k results, but when I bumped it up to 24 hours with 330k results, it failed and gave me that error.

0 Karma

deca2499
Engager

Has anyone seen this in any way? We are running the free version of Splunk and it seems like whatever time range I choose, I get the same error.

Tags (1)
0 Karma

Bhupal
Engager

We just upgraded to 8.2 and seeing this error when trying to export 300k+ results to CSV. 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...