Announcing the SAVIYNT KNOWLEDGE EXCHANGE unifying the Saviynt forums, documentation, training, and more in a single search tool across platforms. Click HERE to read the Announcement.

Splunk Add-On Retry on Failure

Sivagami
Valued Contributor
Valued Contributor

Configured Splunk Add-On in our tenant as per the doc below

https://docs.saviyntcloud.com/bundle/Splunk-Guide/page/Content/Understanding-the-Integration-between... 

We receive timeout errors sometimes accessing the API's and due to which some events generated in Saviynt are missed to be pushed. Is the Splunk Add-on not have the capability of retrying the call if the original call times out?

urllib3.exceptions.ReadTimeoutError: HTTPSConnectionPool(host='myhost.mydomain.com', port=443): Read timed out. (read timeout=120.0)

Increasing the timeout in the Add-on Settings did not resolve the issue as well. Proper retry needs to be configured to avoid events missed to be pushed to SIEM.

-Siva

3 REPLIES 3

Rishi
Saviynt Employee
Saviynt Employee

Hi @Sivagami we do not have the retry option. However can you try to run the same Saviynt API call from postman and check what is the response time? Based on the response time you may want to update the optimum timeout value.

Sivagami
Valued Contributor
Valued Contributor

Hi @Rishi - I believe retry needs to be implemented in the Add-on. We are pulling only 50 records per run via runtime analytics and the response time usually is less than 25 seconds and the time out set was originally 90 and we increased it to 120, 200 and it didn't help.

-Siva

Rishi
Saviynt Employee
Saviynt Employee

@Sivagami i believe this splunk addon was community developed and certified by Saviynt, I will check if it can be enhanced to add retry logic.

Regarding the original issue - it should not take more than 120 seconds to return around 50 records. Can you try running from postman few times and see what is the response time?

Also when timeout occurs do you see any error on Saviynt application log?