Solved: Extending job lifetime via REST - Splunk Community

Getting Data In

Is there a way the extend the lifetime of a job via REST like you can via UI ?

https://docs.splunk.com/Documentation/Splunk/8.0.0/Search/Extendjoblifetimes

I have the problem that the job expires before I can download the data 😞

Markus

1 Solution

Solution

See https://docs.splunk.com/Documentation/Splunk/8.0.0/RESTREF/RESTsearch#search.2Fjobs.2F.7Bsearch_id.7...

---
If this reply helps you, Karma would be appreciated.

View solution in original post

Solution

See https://docs.splunk.com/Documentation/Splunk/8.0.0/RESTREF/RESTsearch#search.2Fjobs.2F.7Bsearch_id.7...

---
If this reply helps you, Karma would be appreciated.

Sorry, but I still don't see how I can change it. i.e. is the custom.ttl ?

Thank you
Markus

After a bit more digging I found it . Thank you.

It is

curl -k -u admin:pass https://localhost:8089/services/search/jobs/mysearch_02151949/control -d action=setttl -d ttl=86400

Markus

Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Deprecation of Splunk Observability Kubernetes “Classic Navigator” UI starting ...

Access to Splunk Observability Kubernetes “Classic Navigator” UI will no longer be available starting January ...

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...