There's probably a better way to do this but what I'm trying to do is search on what has been indexed in the last few seconds, process those results and then search again on the next few seconds. I tried using a real-time search that got a bit complicated.
Pseudo, for you:
service.connect(creds)
earliestTime = getCurrentTime()
sleep(X seconds)
latestTime = getCurrentTime()
While some condition is not met
searchString = "search indexearliest=earliestTime indexlatest=latestTime stuff"
...
searchAndProcessResults(service.oneshotsearch(searchString, jobargs))
earliestTime=latestTime //search up to the previous latest time
latestTime=getCurrentTime() //where there is at least an X seconds gap between earliest and latest time
end While
I'm currently using a oneshot search and reusing the same service object that issues the connect call.
This design works but, long term I need to understand how long I can keep the one connection open before I start seeing errors (if any).
If you've had any success doing something like this via a realtime search on index time, I'd like to hear your suggestions too!
Thanks!
According to Splunk devs, the session token is refreshed each time you submit a new search.
The token expiration is set to 60 minutes by default.
In my case, I don't expect to see any issues with session expiration, which was my motivation for this question.
According to Splunk devs, the session token is refreshed each time you submit a new search.
The token expiration is set to 60 minutes by default.
In my case, I don't expect to see any issues with session expiration, which was my motivation for this question.