Dashboards & Visualizations

Increment TTL of a specific job id

NoIdea
Engager

Hello,

I have multiple dashboards where i user loadjob command since it is very useful to recycle big search results that need to be manipulated in other searches.

I know that unscheduled jobs have a default TTL of 10 minutes and I don't want to change their default TTL globally in the system.

Why I'm asking this question:

if a User access a dashboard with the loadjob command in the code for example at 10AM and then he comes back to the dashboard at 10:15AM I don't want him to see a message about the non existence of the job (like 'Cannot load artifact' or something like this).

To prevent this, I want to create a javascript that recovers the job Id that the User search generated and every 9 minutes increments its TTL by 10 minutes. So the javascript will have a loop where it will wait 9 minutes and change the job id TTL over and over again until the User closes the dashboard (only at that moment I'll let the job expire after 10 minutes so I don't overload the disk).

So, the question is: if I have a job id X, how can I increment only its TTL by adding 10 minutes to it? Is there an SPL command? And how can I launch it from a Javascript?

Thank you very much to anyone who'll help!

Labels (3)
0 Karma

NoIdea
Engager

Please, can someone help me with this solution? I need to provide it to my client.

Thank you very much!

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...