After upgrading ICA to version 6.5.4, the duration of Splunk data source queries increases and may fail with a timeout error such as this:
[1:ERROR] SplunkSearchSession.WaitForCompletion() Inner Exception: Timeout waiting for Job slice to complete after 3600 seconds.
Jobs that complete without errors may ingest duplicate records into the staging table.
Enhancements to data type checking in 6.5.4 resulted in datetime values being recognized and stored in ISO8601 format; however, the stored procedure spIW_RunSplunkImporter had not been updated to handle this format, which resulted in it returning a NULL value for datetime fields used as the watermark column in the IW data source query. Consequently, old and duplicate records were returned, increasing the quantity of data to be processed. The corresponding increase in processing time may exceed the timeout value previously specified, resulting in job failure.
Release : 6.5.4
Component : Splunk Importer
To update the importer and stored procedure to properly handle datetime watermark values, follow this procedure: