Having problems with your account or logging in?
A lot of changes are happening in the community right now. Some may affect you. READ MORE HERE
frag3stream5
Visitor.
155 views

Logger Rest API search with many hits: zero bytes of data returned after 20 minutes+?

Sometimes, with a large timeout on the search of 20 mins +, the Rest API fails to send any data back when I initiate a properly formed request with python requests or pycurl to pull down 5000+ results.

In effect, the results are available but aren't returned. Sometimes I'm able to get results back within 10 minutes, sometimes I get none after 20+. There has been one occasion where I left and came back after several hours and nothing had been returned.

I've tried to chunk the results into batches of 500, but it's not very reliable.and sometimes still results in a hang. When there are few results (50 or less) this hangup issue practically never occurs.

0 Likes
1 Reply
Micro Focus Expert
Micro Focus Expert

Re: Logger Rest API search with many hits: zero bytes of data returned after 20 minutes+?

Someone reported this towards my Logger API SDK as well here:

https://github.com/arcsight-unofficial/arcsight-logger-api-sdkexample/issues/1

I have yet to get enough time to reproduce this, as I have not had this issue.

From what I understand, you run the search, and when it is finished you want to collect the events. If its less than the 10k limit for 1 retrieval, then it is fine, but if you need to re-run events with offset(batching), then it gets slow if the initial results was over the limit. Is that correct?

Out of curiosity, if you run the search through the API, and then log in to the web GUI and retrieve the results, does it still get slow?

-----------------------------------------------------------------------------------------
All topics and replies made is based on my personal opinion, viewpoint and experience, it does not represent the viewpoints of MicroFocus.
All replies is based on best effort, and can not be taken as official support replies.
//Marius
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.