Splunk Dev

Issue DELETE /search/jobs/{search_id} via Java SDK

garypsplunk
New Member

I'm trying to delete search jobs that I no longer need using the Java SDK. The reason is that, when I try to submit a new job, I'm getting the error message com.splunk.HttpException: HTTP 503 -- reason="Search not executed: The maximum disk usage quota for this user has been reached. Use the Job Manager to delete some of your saved search results.", usage=210MB, quota=100MB, user=svc_splunk_mc2, concurrency_category="historical", concurrency_context="user_instance-wide.

When I finish retrieving the results of my search, I do issue a job.cancel() but that seems to issue a POST to search/jobs/{search_id}/control with action=cancel. That releases the cached search results alright but it doesn't seem to delete the search job. In other words, I'm looking for an Java SDK method that will issue a DELETE search/jobs/{search_id}.

I've looked in the Job class but I can't seem to find a method that will issue the DELETE for the job. Am I missing something or do I just need to issue the REST call myself without the benefit of the Java SDK?

Labels (1)
0 Karma

kenharness
New Member

Did anyone find a solution to this? I am facing the same issue

0 Karma

elewis1
Path Finder

Java has a delete method here https://docs.splunk.com/DocumentationStatic/JavaSDK/1.6.4/com/splunk/HttpService.html
"Issues a DELETE request against the service using a given path"

I use the equivalent in Python as this
sdkservice.delete("/services/search/jobs/%s" % (s.jobres.sid))

Most if not all the Splunk SDKs appear to have generic "get" "post" and "delete" functions under the service object returned from a connection. Sure you could do these without the Splunk SDK, but they are helpful since they deal with auth token management and headers for you.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

Ready to make your IT operations smarter and more efficient? Discover how to automate Splunk alerts with Red ...