Search Job HunterKiller
Overview
Details
This alert action accepts a list of SIDs then uses the Splunk REST Search api to modify search jobs.
Using this alert action you can
* Finalize a job
* Pause a job
* Set the workload management pool
* Set the search priority
* Unpause a job
* Cancel a job
* Touch (extends the expiry to now + ttl)
* Set TTL
* Enable events preview
* Disable events preview
* Save
* Unsave
For more detail please refer to https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#search.2Fjobs.2F.7Bsearch_id.7D.2Fcontrol
Brendan Cooper
I am a Splunk Professional Services consultant working for JDS Australia (https://www.jds.net.au), in Sydney, Australia.
What does this app do?
HunterKiller is a alert action that uses the Splunk REST API to manage search jobs. The alert action reads the list of SIDs in the search results and then sends the specified control command to each search job.
It's designed to fill the gaps where workload management can't reach
Typical Use Cases
- Finalizing or cancelling poor search jobs
- Moving jobs to specific workload management pools thereby limiting or increasing resource limits
- Changing priority of a search job
- Extending the life of job results
How does it work
1 - Create a search that returns a list of SIDs that you want you manage. (| rest /services/search/jobs/ | search title=mysearchcritea) The search must return a field called sid
2 - Add the HunterKiller alert action
3 - Select the command you want to send to each job
4 - Save the alert
PS. The alert action only uses the 'sid', 'action' and 'argument' fields.
| rest /services/search/jobs/ returns many, many fields so use the fields or table commands to narrow down what fields are passed on to the alert action.
Advanced
You can also specify the command and it's arguments within the search results. This allows each row to have a different command. Simply set a field called 'action' that contains a valid control command. Arguments for this command can be supplied by setting the 'argument' field.
A full list of commands can be found at https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#search.2Fjobs.2F.7Bsearch_id.7D.2Fcontrol
Support
Support is not guaranteed and will be provided on a best effort basis.
Raise an issue at https://github.com/brendancooper/Splunk-Search-HunterKiller or Send me an email.
Release Notes
Version 8.0.0
Initial Release!