I have a Splunk search which takes long time to execute. I want to stop the Splunk job if it doesn't complete in a minute or 2. Does Splunk REST API have an option for that?
I tried autocancel, timeout and job.cancel, nothing works. Any help greatly appreciated.
code snippet
JobArgs jobargs = new JobArgs();
jobargs.setAutoCancel(60);
jobargs.setTimeout(0);
jobargs.setExecutionMode(JobArgs.ExecutionMode.BLOCKING);
Service service =splunkconnection.connect();
Job job = service.getJobs().create(query, jobargs);
JobResultsArgs resultsArgs = new JobResultsArgs();
resultsArgs.setCount(0);
resultsArgs.setOutputMode(JobResultsArgs.OutputMode.JSON);
InputStream resultsNormalSearch = job.getResults(resultsArgs);
reader= new ResultsReaderJson(resultsNormalSearch);
HashMap<String, String> event;
while ((event = reader.getNextEvent()) != null) {
-- process response
}
resultsReader.close();
job.cancel();
It looks like you can send a cancel request via the job control API:
It doesn't look exactly like what you are looking for, but there is also an auto_cancel and auto_finalize option to the jobs method when you submit a job.
we can't get the jobid to send a cancel request. but the auto cancel seems to be working. Thanks.
Does any know how to implement this?