Dashboards & Visualizations

Increment TTL of a specific job id

NoIdea
Engager

Hello,

I have multiple dashboards where i user loadjob command since it is very useful to recycle big search results that need to be manipulated in other searches.

I know that unscheduled jobs have a default TTL of 10 minutes and I don't want to change their default TTL globally in the system.

Why I'm asking this question:

if a User access a dashboard with the loadjob command in the code for example at 10AM and then he comes back to the dashboard at 10:15AM I don't want him to see a message about the non existence of the job (like 'Cannot load artifact' or something like this).

To prevent this, I want to create a javascript that recovers the job Id that the User search generated and every 9 minutes increments its TTL by 10 minutes. So the javascript will have a loop where it will wait 9 minutes and change the job id TTL over and over again until the User closes the dashboard (only at that moment I'll let the job expire after 10 minutes so I don't overload the disk).

So, the question is: if I have a job id X, how can I increment only its TTL by adding 10 minutes to it? Is there an SPL command? And how can I launch it from a Javascript?

Thank you very much to anyone who'll help!

Labels (3)
0 Karma

NoIdea
Engager

Please, can someone help me with this solution? I need to provide it to my client.

Thank you very much!

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...