Hi guys,
I have a nodejs service that needs to perform number of sequential queries:
e.g:
search mysearch from 01/01/2018 00:00:00 to 00:05:00
search mysearch from 01/01/2018 00:05:00 to 00:10:00
search mysearch from 01/01/2018 00:10:00 to 00:15:00
....
....
until 14/01/2018 00:00:00
The queries are very fast ( < 1s)
In my tests environment I have no problem (Splunk version 6.5.2)
In my production environment (Splunk version: 6.6.2), after some queries I receive an error:
[SPLUNKD] Unknown sid.
error: SplunkSearcher.search :: Error {"response":{"headers":{"date":"Mon, 05 Feb 2018 12:45:31 GMT","expires":"Thu, 26 Oct 1978 00:00:00 GMT","cache-control":"no-store, no-cache, must-revalidate, max-age=0","content-type":"application/json; charset=UTF-8","x-content-type-options":"nosniff","content-length":"53","vary":"Cookie, Authorization","connection":"Close","set-cookie":["splunkd_8089=jlHwfXrZZNgO.....; Path=/; Secure; HttpOnly; Max-Age=3600; Expires=Mon, 05 Feb 2018 13:45:31 GMT"],"x-frame-options":"SAMEORIGIN","server":"Splunkd"},"statusCode":404},"status":404,"data":{"messages":[{"type":"FATAL","text":"Unknown sid."}]},"error":null}
The nodejs service and the Splunk server are on the same server.
What could be the problem and how can I debug it?
thank you
