I hope this is the correct board for this question, but I am having an issue when I try to export a search to CSV from a search. I keep getting the following error when trying to run the export. Has anyone seen this and how to resolve it? I am using version 8.1.2 FWIW.
Unrecoverable error in the server. Traceback (most recent call last): File "C:\Program Files\Splunk\Python-3.7\lib\site-packages\cherrypy\_cpwsgi.py", line 184, in trap return func(*args, **kwargs) File "C:\Program Files\Splunk\Python-3.7\lib\site-packages\cherrypy\_cpwsgi.py", line 277, in __next__ return next(self.iter_response) File "C:\Program Files\Splunk\Python-3.7\lib\site-packages\cherrypy\lib\encoding.py", line 99, in encoder for chunk in body: File "C:\Program Files\Splunk\Python-3.7\lib\site-packages\splunk\rest\__init__.py", line 698, in readall data = response.read(blocksize) File "C:\Program Files\Splunk\Python-3.7\lib\http\client.py", line 457, in read n = self.readinto(b) File "C:\Program Files\Splunk\Python-3.7\lib\http\client.py", line 501, in readinto n = self.fp.readinto(b) File "C:\Program Files\Splunk\Python-3.7\lib\socket.py", line 589, in readinto return self._sock.recv_into(b) File "C:\Program Files\Splunk\Python-3.7\lib\ssl.py", line 1071, in recv_into return self.read(nbytes, buffer) File "C:\Program Files\Splunk\Python-3.7\lib\ssl.py", line 929, in read return self._sslobj.read(len, buffer) socket.timeout: The read operation timed out
How long does the search for 14k result take and how long does that for 24 hrs take ? When you export report to csv from UI, you have this message on the lower part of the dialogue box "Your search will rerun if the number of results is higher than 1,000". So my guess is that the 24 hours is taking to much time to run- beyond the timeout setting.