Splunk Dev

Java SDK: How to close normal job execution?

jakubzak
Explorer

Hello, 

 I have a backend implementation utilizing Java SDK. I execute a search that is finalized successfully (seach is limited to return first 10 records) as a 1st step of a overall logic. Based on this result set I execute another search in a loop that streams its results back to front end application once it gets data (one execution per each record returned by 1st search). In that part I am executing always exactly the same search but with different parameters (results of 1st search). After few executions in that loop, once standard timeout for one execution is reached (60 sec) I receive "...com.splunk.HttpException: HTTP 404 -- Unknown sid" exception. When I debug my code I can see that exception is thrown on a job in RUNNING state. All previous jobs in that loop are marked as DONE, all "ResultsReaders" are closed. It seems that expiration is evaluated on start time of first job in a execution, not based on the actual one (even if a job is in a Java code declared as a new job).

How is the job expiration logic working?

Note: I am not asking for "why you are calling it in a loop" 🙂 I am asking for information how to properly close/finalize normal job execution so I reset timer for each execution of this normal job. 

Thanks for your answers, notes, updates 🙂

Jakub

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...