Splunk Search

Will increasing Elasticsplunk application timeout resolve this error?

splunkcol
Builder

 

Hello
I am currently managing a hybrid between Splunk and ELK (Elastisearch Logstash Kibana).

Logs supporting syslog protocol are sent to ELK and logs from other sources directly to windows via agent.

A plugin called Elasticsplunk has been installed and is stored in the path /splunk/splunk/etc/apps/elasticsplunk/.

Currently I am getting the following error message and I would like you to please help me if you know in which configuration file I increase the timeout

 

 

External search command 'ess' returned error code 1. Script output = "error_message=ConnectionTimeout at "/var2/splunk/splunk/etc/apps/elasticsplunk/bin/elasticsearch/connection/http_urllib3.py", line 155 : ConnectionTimeout caused by - ReadTimeoutError(HTTPConnectionPool(host=u'localhost', port=9200): Read timed out. (read timeout=60)) ".”

 

Labels (1)
0 Karma

Tom_Lundie
Contributor

EDIT: For Elastic Python (v6)

This project has been archived on GitHub so you are quite unlikely to get support from the creator.
Looking through the code, there is no timeout argument for the ess command, so not a lot you can do on the Splunk-side.

If you're happy to have a go at editing the code, then the Elasticsearch.search method in the Elastic Python SDK (v6) takes a timeout argument. Have a go at adding it under line 266 in ./elasticsplunk/bin/elasticsplunk.py:

            res = esclient.search(index=config[KEY_CONFIG_INDEX],
size=config[KEY_CONFIG_LIMIT],
_source_include=config[KEY_CONFIG_FIELDS],
doc_type=config[KEY_CONFIG_SOURCE_TYPE],
body=body)

Add the timeout argument as follows (don't forget the comma at the end of the body line):

            res = esclient.search(index=config[KEY_CONFIG_INDEX],
size=config[KEY_CONFIG_LIMIT],
_source_include=config[KEY_CONFIG_FIELDS],
doc_type=config[KEY_CONFIG_SOURCE_TYPE],
body=body,
timeout=600)

FYI, I haven't tested this because I don't have elastic, but looking through the code, I think this will work. There are also some elastic add-ons on Splunkbase that might be worth checking out to see if they're actively supported?

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...