Building for the Splunk Platform

Issue DELETE /search/jobs/{search_id} via Java SDK

garypsplunk
New Member

I'm trying to delete search jobs that I no longer need using the Java SDK. The reason is that, when I try to submit a new job, I'm getting the error message com.splunk.HttpException: HTTP 503 -- reason="Search not executed: The maximum disk usage quota for this user has been reached. Use the Job Manager to delete some of your saved search results.", usage=210MB, quota=100MB, user=svc_splunk_mc2, concurrency_category="historical", concurrency_context="user_instance-wide.

When I finish retrieving the results of my search, I do issue a job.cancel() but that seems to issue a POST to search/jobs/{search_id}/control with action=cancel. That releases the cached search results alright but it doesn't seem to delete the search job. In other words, I'm looking for an Java SDK method that will issue a DELETE search/jobs/{search_id}.

I've looked in the Job class but I can't seem to find a method that will issue the DELETE for the job. Am I missing something or do I just need to issue the REST call myself without the benefit of the Java SDK?

Labels (2)
0 Karma

kenharness
New Member

Did anyone find a solution to this? I am facing the same issue

0 Karma

elewis1
Explorer

Java has a delete method here https://docs.splunk.com/DocumentationStatic/JavaSDK/1.6.4/com/splunk/HttpService.html
"Issues a DELETE request against the service using a given path"

I use the equivalent in Python as this
sdkservice.delete("/services/search/jobs/%s" % (s.jobres.sid))

Most if not all the Splunk SDKs appear to have generic "get" "post" and "delete" functions under the service object returned from a connection. Sure you could do these without the Splunk SDK, but they are helpful since they deal with auth token management and headers for you.

0 Karma
Get Updates on the Splunk Community!

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...