Building for the Splunk Platform

Issue DELETE /search/jobs/{search_id} via Java SDK

garypsplunk
New Member

I'm trying to delete search jobs that I no longer need using the Java SDK. The reason is that, when I try to submit a new job, I'm getting the error message com.splunk.HttpException: HTTP 503 -- reason="Search not executed: The maximum disk usage quota for this user has been reached. Use the Job Manager to delete some of your saved search results.", usage=210MB, quota=100MB, user=svc_splunk_mc2, concurrency_category="historical", concurrency_context="user_instance-wide.

When I finish retrieving the results of my search, I do issue a job.cancel() but that seems to issue a POST to search/jobs/{search_id}/control with action=cancel. That releases the cached search results alright but it doesn't seem to delete the search job. In other words, I'm looking for an Java SDK method that will issue a DELETE search/jobs/{search_id}.

I've looked in the Job class but I can't seem to find a method that will issue the DELETE for the job. Am I missing something or do I just need to issue the REST call myself without the benefit of the Java SDK?

Labels (2)
0 Karma

kenharness
New Member

Did anyone find a solution to this? I am facing the same issue

0 Karma

elewis1
Explorer

Java has a delete method here https://docs.splunk.com/DocumentationStatic/JavaSDK/1.6.4/com/splunk/HttpService.html
"Issues a DELETE request against the service using a given path"

I use the equivalent in Python as this
sdkservice.delete("/services/search/jobs/%s" % (s.jobres.sid))

Most if not all the Splunk SDKs appear to have generic "get" "post" and "delete" functions under the service object returned from a connection. Sure you could do these without the Splunk SDK, but they are helpful since they deal with auth token management and headers for you.

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...