Splunk Search

Why is the nodejs unable to perform a number of sequential queries?

faustf
Communicator

Hi guys,

I have a nodejs service that needs to perform number of sequential queries:
e.g:

search mysearch from 01/01/2018 00:00:00 to 00:05:00
search mysearch from 01/01/2018 00:05:00 to 00:10:00
search mysearch from 01/01/2018 00:10:00 to 00:15:00
....
....
until 14/01/2018 00:00:00

The queries are very fast ( < 1s)

In my tests environment I have no problem (Splunk version 6.5.2)

In my production environment (Splunk version: 6.6.2), after some queries I receive an error:

[SPLUNKD] Unknown sid.
error: SplunkSearcher.search :: Error {"response":{"headers":{"date":"Mon, 05 Feb 2018 12:45:31 GMT","expires":"Thu, 26 Oct 1978 00:00:00 GMT","cache-control":"no-store, no-cache, must-revalidate, max-age=0","content-type":"application/json; charset=UTF-8","x-content-type-options":"nosniff","content-length":"53","vary":"Cookie, Authorization","connection":"Close","set-cookie":["splunkd_8089=jlHwfXrZZNgO.....; Path=/; Secure; HttpOnly; Max-Age=3600; Expires=Mon, 05 Feb 2018 13:45:31 GMT"],"x-frame-options":"SAMEORIGIN","server":"Splunkd"},"statusCode":404},"status":404,"data":{"messages":[{"type":"FATAL","text":"Unknown sid."}]},"error":null}

The nodejs service and the Splunk server are on the same server.

What could be the problem and how can I debug it?

thank you

0 Karma

faustf
Communicator

No one can help me?

0 Karma

paramagurukarth
Builder

Even I had similar issue when I was working with nodeJs...
But in a different environment.. CLient Browser + Server NodeJs(web component)..

In my issue the problem was not with node js... It was with the client browser.. Maximum concurrent session for a domain is 6...

May be your issue is also in the consumer part.. nodejs mostly works fine..
Try investigate on your consumer side as well...
It may queue your requests...

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...