Hello,   I have a backend implementation utilizing Java SDK. I execute a search that is finalized successfully (seach is limited to return first 10 records) as a 1st step of a overall logic. Based on this result set I execute another search in a loop that streams its results back to front end application once it gets data (one execution per each record returned by 1st search). In that part I am executing always exactly the same search but with different parameters (results of 1st search). After few executions in that loop, once standard timeout for one execution is reached (60 sec) I receive "...com.splunk.HttpException: HTTP 404 -- Unknown sid" exception. When I debug my code I can see that exception is thrown on a job in RUNNING state. All previous jobs in that loop are marked as DONE, all "ResultsReaders" are closed. It seems that expiration is evaluated on start time of first job in a execution, not based on the actual one (even if a job is in a Java code declared as a new job). How is the job expiration logic working? Note: I am not asking for "why you are calling it in a loop" 🙂 I am asking for information how to properly close/finalize normal job execution so I reset timer for each execution of this normal job.  Thanks for your answers, notes, updates 🙂 Jakub ... View more

I have created following custom command: @Configuration(streaming=True) class GenerateTextCommand(GeneratingCommand): count = Option(require=True, validate=validators.Integer(0)) text = Option(require=True) def generate(self): for i in range(1, self.count + 1): sleep(5) yield {'id': i, '_time': time.time(), '_raw': unicode(i) + '. ' + self.text} dispatch(GenerateTextCommand, sys.argv, sys.stdin, sys.stdout, __name__) and I have prepared configuration in commands.conf: [teststream] filename = testStream.py chunked = true My expectation is that if I execute this command in Search command line in Splunk UI: | teststream count=4 text="asdf" It will print out each 5 seconds asdf text 4 times. Instead of it it generates 4 events and prints it after 20 seconds. Timestamps shows that generation time is strictly by "my rules" - new message each 5 seconds. Is my understanding of "output streaming" from custom command incorrect or am I doing something wrong? Thanks for help Jakub ... View more