Splunk Dev

Issue DELETE /search/jobs/{search_id} via Java SDK

garypsplunk
New Member

I'm trying to delete search jobs that I no longer need using the Java SDK. The reason is that, when I try to submit a new job, I'm getting the error message com.splunk.HttpException: HTTP 503 -- reason="Search not executed: The maximum disk usage quota for this user has been reached. Use the Job Manager to delete some of your saved search results.", usage=210MB, quota=100MB, user=svc_splunk_mc2, concurrency_category="historical", concurrency_context="user_instance-wide.

When I finish retrieving the results of my search, I do issue a job.cancel() but that seems to issue a POST to search/jobs/{search_id}/control with action=cancel. That releases the cached search results alright but it doesn't seem to delete the search job. In other words, I'm looking for an Java SDK method that will issue a DELETE search/jobs/{search_id}.

I've looked in the Job class but I can't seem to find a method that will issue the DELETE for the job. Am I missing something or do I just need to issue the REST call myself without the benefit of the Java SDK?

Labels (2)
0 Karma

kenharness
New Member

Did anyone find a solution to this? I am facing the same issue

0 Karma

elewis1
Explorer

Java has a delete method here https://docs.splunk.com/DocumentationStatic/JavaSDK/1.6.4/com/splunk/HttpService.html
"Issues a DELETE request against the service using a given path"

I use the equivalent in Python as this
sdkservice.delete("/services/search/jobs/%s" % (s.jobres.sid))

Most if not all the Splunk SDKs appear to have generic "get" "post" and "delete" functions under the service object returned from a connection. Sure you could do these without the Splunk SDK, but they are helpful since they deal with auth token management and headers for you.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...