Dashboards & Visualizations

Why is the SDK Javascript auto_cancel expiring after 10 minutes?

faustf
Communicator

Hi guys,

I have a javascript service that performs a query every 30 seconds:

let service = new this.splunkjs.Service({
        username: process.env.SEARCHER_USERNAME,
        password: process.env.SEARCHER_PASSWORD,
        scheme: process.env.SEARCHER_SCHEME,
        host: process.env.SEARCHER_HOST,
        port: process.env.SEARCHER_PORT,
        version: process.env.SEARCHER_VERSION
    });

    // Set the search parameters
    let searchParams = {
        exec_mode: "blocking",
        auto_cancel: process.env.SEARCHER_AUTO_CANCEL_JOB_SEC,
        output_mode: "JSON",
        rf: "*"
    };

service.search(
        searchQuery,
        searchParams,
        ...
        ....
        ......

even If I set SEARCHER_AUTO_CANCEL_JOB_SEC=30, if I go to Activities/Jobs (in the Splunk Web Application) the job Expires date is 10 minutes after the Created at date. I was expecting 30 seconds not 10 minutes.

Splunk version: 6.6.2

Thank you

0 Karma

bojanisch
Path Finder

Hi @faustf,

I haven't used this SEARCHER_AUTO_CANCEL_JOB_SEC parameter yet, but if you want to reduce the expiration time of your results, limits.conf is the way to go.

See https://answers.splunk.com/answers/52973/how-to-set-search-result-no-expiration.html which answered this previously.

0 Karma

faustf
Communicator

But it will reduce the expiration time for all JOBs.
I would like to do it using the SDK and only for my JOBs.

thank you for your answer

0 Karma

bojanisch
Path Finder

Okay and have you already tried setting the TTL (time to live) of your search job? See http://docs.splunk.com/DocumentationStatic/JavaScriptSDK/1.0/splunkjs.Service.Job.html under setTTL for an example.

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...