Why is the SDK Javascript auto_cancel expiring after 10 minutes?

[faustf]

Hi guys,

I have a javascript service that performs a query every 30 seconds:

let service = new this.splunkjs.Service({
        username: process.env.SEARCHER_USERNAME,
        password: process.env.SEARCHER_PASSWORD,
        scheme: process.env.SEARCHER_SCHEME,
        host: process.env.SEARCHER_HOST,
        port: process.env.SEARCHER_PORT,
        version: process.env.SEARCHER_VERSION
    });

    // Set the search parameters
    let searchParams = {
        exec_mode: "blocking",
        auto_cancel: process.env.SEARCHER_AUTO_CANCEL_JOB_SEC,
        output_mode: "JSON",
        rf: "*"
    };

service.search(
        searchQuery,
        searchParams,
        ...
        ....
        ......

even If I set SEARCHER_AUTO_CANCEL_JOB_SEC=30, if I go to Activities/Jobs (in the Splunk Web Application) the job Expires date is 10 minutes after the Created at date. I was expecting 30 seconds not 10 minutes.

Splunk version: 6.6.2

Thank you

[bojanisch]

Hi @faustf,

I haven't used this SEARCHER_AUTO_CANCEL_JOB_SEC parameter yet, but if you want to reduce the expiration time of your results, limits.conf is the way to go.

See https://answers.splunk.com/answers/52973/how-to-set-search-result-no-expiration.html which answered this previously.

[faustf]

But it will reduce the expiration time for all JOBs.
I would like to do it using the SDK and only for my JOBs.

thank you for your answer

[bojanisch]

Okay and have you already tried setting the TTL (time to live) of your search job? See http://docs.splunk.com/DocumentationStatic/JavaScriptSDK/1.0/splunkjs.Service.Job.html under setTTL for an example.