Building for the Splunk Platform

Java SDK: How to close normal job execution?

jakubzak
Explorer

Hello, 

 I have a backend implementation utilizing Java SDK. I execute a search that is finalized successfully (seach is limited to return first 10 records) as a 1st step of a overall logic. Based on this result set I execute another search in a loop that streams its results back to front end application once it gets data (one execution per each record returned by 1st search). In that part I am executing always exactly the same search but with different parameters (results of 1st search). After few executions in that loop, once standard timeout for one execution is reached (60 sec) I receive "...com.splunk.HttpException: HTTP 404 -- Unknown sid" exception. When I debug my code I can see that exception is thrown on a job in RUNNING state. All previous jobs in that loop are marked as DONE, all "ResultsReaders" are closed. It seems that expiration is evaluated on start time of first job in a execution, not based on the actual one (even if a job is in a Java code declared as a new job).

How is the job expiration logic working?

Note: I am not asking for "why you are calling it in a loop" 🙂 I am asking for information how to properly close/finalize normal job execution so I reset timer for each execution of this normal job. 

Thanks for your answers, notes, updates 🙂

Jakub

Labels (1)
0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...