I have a Splunk search which takes long time to execute. I want to stop the Splunk job if it doesn't complete in a minute or 2. Does Splunk REST API have an option for that?
I tried autocancel, timeout and job.cancel, nothing works. Any help greatly appreciated.
code snippet
JobArgs jobargs = new JobArgs();
jobargs.setAutoCancel(60);
jobargs.setTimeout(0);
jobargs.setExecutionMode(JobArgs.ExecutionMode.BLOCKING);
Service service =splunkconnection.connect();
Job job = service.getJobs().create(query, jobargs);
JobResultsArgs resultsArgs = new JobResultsArgs();
resultsArgs.setCount(0);
resultsArgs.setOutputMode(JobResultsArgs.OutputMode.JSON);
InputStream resultsNormalSearch = job.getResults(resultsArgs);
reader= new ResultsReaderJson(resultsNormalSearch);
HashMap<String, String> event;
while ((event = reader.getNextEvent()) != null) {
-- process response
}
resultsReader.close();
job.cancel();
... View more