How long can I keep an open connection to Splunk search head via SDK?

[rbarajas]

There's probably a better way to do this but what I'm trying to do is search on what has been indexed in the last few seconds, process those results and then search again on the next few seconds. I tried using a real-time search that got a bit complicated.

Pseudo, for you:

    service.connect(creds)

    earliestTime = getCurrentTime()
    sleep(X seconds)
    latestTime = getCurrentTime()

    While some condition is not met
       searchString = "search indexearliest=earliestTime indexlatest=latestTime stuff"
       ...
       searchAndProcessResults(service.oneshotsearch(searchString, jobargs))
       earliestTime=latestTime  //search up to the previous latest time
       latestTime=getCurrentTime()  //where there is at least an X seconds gap between earliest and latest time
    end While

I'm currently using a oneshot search and reusing the same service object that issues the connect call.

This design works but, long term I need to understand how long I can keep the one connection open before I start seeing errors (if any).

If you've had any success doing something like this via a realtime search on index time, I'd like to hear your suggestions too!

Thanks!

[rbarajas · Accepted solution]

According to Splunk devs, the session token is refreshed each time you submit a new search.
The token expiration is set to 60 minutes by default.
In my case, I don't expect to see any issues with session expiration, which was my motivation for this question.