Hi, I am getting the following error when trying to capture data on one of my Splunk destinations.
These type of errors occur when a network device (Load Balancer or Application Gateway) has an idle or request timeout setting too low. While doing the capture, if there aren’t any events coming through, then the timeout value kicks in and that capture is cancelled with the Gateway Time-out.
To view more details about the error, go to Menu > More Tools > Dev Tools. Select the Network tab and recreate the issue. From there, we see that we got back a 504 Gateway Time-out on the capture and shows in red. Quick tip, to recreate the issue faster, add a dummy field and/or value to the Filter so that no events match.
Network > Headers
Click on the capture call in red. Within the Headers tab, there are a few more details on where the message is coming from.
Status : 504 Gateway Time-out (from service worker)
Server : Microsoft-Azure-Application-Gateway
Network > Response
Within the Response tab, we see 504 Gateway Time-out and Microsoft-Azure-Application-Gateway
With this information or any other related errors that we may be getting back, you’re able to then go back to the Network team and have them investigate further. The idle or request timeout setting will need to be increased.
Once the change has been made, to validate the issue has been addressed, do the Live Capture again and include a dummy field and value. This will prevent any data to come back and simulate no events being returned. The capture will then be able to continue to run and completes successfully without any issues.
1 UpGoat