Support Questions

Find answers, ask questions, and share your expertise

getsplunk processor fails on complex queries?

avatar
Contributor

Is it possible that complex splunk queries are too much for the getsplunk processor? These queries are a few hundred lines long, but run fine in the splunk GUI. Error is below, and recommendations on how to troublehshoot?

10:11:06 ESTERRORf46c3d86-5571-146c-a8ef-071da5f520e6 denatb3wlwbl08.cloud.myco.org:8443GetSplunk[id=f46c3d86-5571-146c-a8ef-071da5f520e6] Failed to process session due to org.apache.nifi.processor.exception.ProcessException: IOException thrown from GetSplunk[id=f46c3d86-5571-146c-a8ef-071da5f520e6]: java.net.SocketException: Connection reset: org.apache.nifi.processor.exception.ProcessException: IOException thrown from GetSplunk[id=f46c3d86-5571-146c-a8ef-071da5f520e6]: java.net.SocketException: Connection reset

1 ACCEPTED SOLUTION

avatar
Contributor

Answering my own question. This was happening because of the load balancer between Nifi and splunk. Hitting splunk directly resolved the issue.

View solution in original post

1 REPLY 1

avatar
Contributor

Answering my own question. This was happening because of the load balancer between Nifi and splunk. Hitting splunk directly resolved the issue.