Timeout Error when Exporting to CSV file on SH

Applicability

Splunk Enterprise Splunk Cloud

Description

Issue:
The error "socket.timeout: The read operation timed out" occurs when exporting more than 10000 lines of data. It seems to timeout after 30 seconds after asking it to export to csv. The actual search takes just under 2 mins, and since when it does the export, it has to rerun the search, it seems to be hitting some 30-second timeout somewhere so the export fails.

The error message is the following:

Unrecoverable error in the server.
Traceback (most recent call last):
File "/opt/splunk/lib/python3.7/site-packages/cherrypy/_cpwsgi.py", line 184, in trap
return func(*args, **kwargs)
File "/opt/splunk/lib/python3.7/site-packages/cherrypy/_cpwsgi.py", line 277, in __next__
return next(self.iter_response)
File "/opt/splunk/lib/python3.7/site-packages/cherrypy/lib/encoding.py", line 99, in encoder
for chunk in body:
File "/opt/splunk/lib/python3.7/site-packages/splunk/rest/__init__.py", line 698, in readall
data = response.read(blocksize)
File "/opt/splunk/lib/python3.7/http/client.py", line 457, in read
n = self.readinto(b)
File "/opt/splunk/lib/python3.7/http/client.py", line 501, in readinto
n = self.fp.readinto(b)
File "/opt/splunk/lib/python3.7/socket.py", line 589, in readinto
return self._sock.recv_into(b)
File "/opt/splunk/lib/python3.7/ssl.py", line 1071, in recv_into
return self.read(nbytes, buffer)
File "/opt/splunk/lib/python3.7/ssl.py", line 929, in read
return self._sslobj.read(len, buffer)
socket.timeout: The read operation timed out

Investigation

There is a hardcoded limit of 10000 lines when exporting data. Exporting a big number of lines could take a little time to gather and may be hitting default Timeouts (30 seconds)

The Error reported was:

socket.timeout: The read operation timed out.

Resolution

Hitting this timeout limit on your SH:

splunk@sh-i-xxx:~$ splunk btool web list --debug | grep splunkdConnectionTimeout
/opt/splunk/etc/system/default/web.conf splunkdConnectionTimeout = 30

The "splunkdConnectionTimeout" attribute in the web.conf file is currently configured to the default value of 30 seconds, which corresponds with the behavior.
Increase splunkdConnectionTimeout in $SPLUNK_HOME/etc/system/local/web.conf (or other paths) to 300 seconds under the "settings" stanza:

[settings]
splunkdConnectionTimeout = 300

If the above does not work, you can also try increasing the default Splunkd Connection Timeout settings for UI and Splunk-Splunk Comms to 300 seconds in the same web.conf under "settings":

export_timeout = 300
server.socket_timeout = 300

Please note that Splunk will need to be restarted after making any of the above changes.

For details regarding the above attributes, please refer to the following link:
web.conf.spec

Related Links

Splunk Documentation:
web.conf
Help! I can't export more than 10,000 events!
Splunkd daemon is not responding: ('The read operation timed out',)
 

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release