Hi everyone,
I have an issue when trying to generate a scheduled view and send it via email.
Reading similar issues in the community, I set the following parameters in the savedsearches.conf file:
action.email.maxtime = 3600m
dispatch.max_time = 14400
increased the limits in limits.conf:
[pdf]
render_endpoint_timeout = 14400
[scheduler]
scheduled_view_timeout = 240m
and the splunkd timeout in web.conf:
splunkdConnectionTimeout = 14400
In other words, I tried to extend the timeout to 4 hours.
Nevertheless, after 1 hour the process tries to finalize the results and send the email, but it doesn't find any result and fails. This is the first line of the process inspector (see the timeout still set on 3600 seconds):
This search has completed in 3.608,538 seconds, but did not match any events
And this is the python.log (anonymized), see that seach starts at 12:00 and sendmail tries to send mail after 1 hour:
2020-11-09 12:00:48,466 +0100 INFO sendemail:1149 - sendemail pdfgen_available = 1
2020-11-09 12:00:48,466 +0100 INFO sendemail:1294 - sendemail:mail effectiveTime=1604919600
2020-11-09 13:00:48,502 +0100 ERROR __init__:499 - Socket error communicating with splunkd (error=('The read operation timed out',)), path = /services/pdfgen/render
2020-11-09 13:00:48,503 +0100 ERROR sendemail:1156 - An error occurred while generating a PDF: Failed to fetch PDF (SplunkdConnectionException): Splunkd daemon is not responding: ("Error connecting to /services/pdfgen/render: ('The read operation timed out',)",)
2020-11-09 13:00:48,503 +0100 INFO sendemail:1175 - buildAttachments: not attaching csv as there are no results
2020-11-09 13:00:52,118 +0100 INFO sendemail:134 - Sending email. subject="Splunk Dashboard: '<DASHBOARD_NAME>'", results_link="https://<SERVER_NAME>:8000/app/<app_name>/@go?sid=", recipients="[u'user_name@domain_name.it']", server="smtprelay.domain_name.it:25"
Has anybody ever had the same issue? Can anyone help me?
Thanks in advance.
