Python SDK and Rest endpoint /search/jobs are not working as intended in setting ttl and querying custom parameters

strive — Tue, 29 Sep 2020 22:09:59 GMT

Hi,

We extensively use splunklib.client and service.jobs to create jobs, retrieve jobs and iter over, and set ttl. All these things were working fine in Splunk 6.4.5 & Python SDK 1.6.2.

In Splunk 7.0.7 & Python SDK 1.6.2, the service.jobs.iter(search=query) and job.set_ttl are not working. More details below.

We post search jobs along with custom parameters. Later we retrieve the jobs matching some custom parameters.
For example: If custom.notify_method="email", custom.notify_server="my mail server" are our custom parameters

query='custom.notify_method="email" AND custom.notify_server="my mail server"'
service.jobs.iter(search=query)

returns nothing.

for job in service.jobs:
    job.set_ttl(60)

The ttl and eai:acl.ttl are set to 60. After 60 seconds, the ttl value becomes 0 but the eai:acl.ttl value remains as 60.
The job never expires and it stays for 7 days.
Why the jobs are not getting deleted after 60 seconds even though the ttl value has been updated to 0?

Both the above mentioned issues are in Splunk 7.0.7 & Python SDK 1.6.2. But they were working as intended in 6.4.5 and SDK 1.6.2

Any pointers to solve these issues.

Thanks,
Strive

Re: Python SDK and Rest endpoint /search/jobs are not working as intended in setting ttl and querying custom parameters

strive — Mon, 10 Dec 2018 07:01:21 GMT

Splunk team have told that it is a bug and it will be fixed.

topic Python SDK and Rest endpoint /search/jobs are not working as intended in setting ttl and querying custom parameters in Splunk Dev

Python SDK and Rest endpoint /search/jobs are not working as intended in setting ttl and querying custom parameters

Re: Python SDK and Rest endpoint /search/jobs are not working as intended in setting ttl and querying custom parameters