Splunk Dev

Issue DELETE /search/jobs/{search_id} via Java SDK

garypsplunk
New Member

I'm trying to delete search jobs that I no longer need using the Java SDK. The reason is that, when I try to submit a new job, I'm getting the error message com.splunk.HttpException: HTTP 503 -- reason="Search not executed: The maximum disk usage quota for this user has been reached. Use the Job Manager to delete some of your saved search results.", usage=210MB, quota=100MB, user=svc_splunk_mc2, concurrency_category="historical", concurrency_context="user_instance-wide.

When I finish retrieving the results of my search, I do issue a job.cancel() but that seems to issue a POST to search/jobs/{search_id}/control with action=cancel. That releases the cached search results alright but it doesn't seem to delete the search job. In other words, I'm looking for an Java SDK method that will issue a DELETE search/jobs/{search_id}.

I've looked in the Job class but I can't seem to find a method that will issue the DELETE for the job. Am I missing something or do I just need to issue the REST call myself without the benefit of the Java SDK?

Labels (1)
0 Karma

kenharness
New Member

Did anyone find a solution to this? I am facing the same issue

0 Karma

elewis1
Path Finder

Java has a delete method here https://docs.splunk.com/DocumentationStatic/JavaSDK/1.6.4/com/splunk/HttpService.html
"Issues a DELETE request against the service using a given path"

I use the equivalent in Python as this
sdkservice.delete("/services/search/jobs/%s" % (s.jobres.sid))

Most if not all the Splunk SDKs appear to have generic "get" "post" and "delete" functions under the service object returned from a connection. Sure you could do these without the Splunk SDK, but they are helpful since they deal with auth token management and headers for you.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...