Splunk Search

Will increasing Elasticsplunk application timeout resolve this error?

splunkcol
Builder

 

Hello
I am currently managing a hybrid between Splunk and ELK (Elastisearch Logstash Kibana).

Logs supporting syslog protocol are sent to ELK and logs from other sources directly to windows via agent.

A plugin called Elasticsplunk has been installed and is stored in the path /splunk/splunk/etc/apps/elasticsplunk/.

Currently I am getting the following error message and I would like you to please help me if you know in which configuration file I increase the timeout

 

 

External search command 'ess' returned error code 1. Script output = "error_message=ConnectionTimeout at "/var2/splunk/splunk/etc/apps/elasticsplunk/bin/elasticsearch/connection/http_urllib3.py", line 155 : ConnectionTimeout caused by - ReadTimeoutError(HTTPConnectionPool(host=u'localhost', port=9200): Read timed out. (read timeout=60)) ".”

 

Labels (1)
0 Karma

Tom_Lundie
Contributor

EDIT: For Elastic Python (v6)

This project has been archived on GitHub so you are quite unlikely to get support from the creator.
Looking through the code, there is no timeout argument for the ess command, so not a lot you can do on the Splunk-side.

If you're happy to have a go at editing the code, then the Elasticsearch.search method in the Elastic Python SDK (v6) takes a timeout argument. Have a go at adding it under line 266 in ./elasticsplunk/bin/elasticsplunk.py:

            res = esclient.search(index=config[KEY_CONFIG_INDEX],
size=config[KEY_CONFIG_LIMIT],
_source_include=config[KEY_CONFIG_FIELDS],
doc_type=config[KEY_CONFIG_SOURCE_TYPE],
body=body)

Add the timeout argument as follows (don't forget the comma at the end of the body line):

            res = esclient.search(index=config[KEY_CONFIG_INDEX],
size=config[KEY_CONFIG_LIMIT],
_source_include=config[KEY_CONFIG_FIELDS],
doc_type=config[KEY_CONFIG_SOURCE_TYPE],
body=body,
timeout=600)

FYI, I haven't tested this because I don't have elastic, but looking through the code, I think this will work. There are also some elastic add-ons on Splunkbase that might be worth checking out to see if they're actively supported?

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...