topic Re: how to cancel the monitoring job in Splunk Search

how to cancel the monitoring job

johnsmithcy — Wed, 16 Jan 2019 01:36:37 GMT

i am new to splunk. I have created a job to monitoring localhost performance. How can I delete the monitoring job and find the monitoring job I have created?

Re: how to cancel the monitoring job

inventsekar — Wed, 16 Jan 2019 05:05:00 GMT

may we know if you have splunk admin access or user access? when you click "settings" --> under KNOWLEDGE select "Searches, reports, and alerts"... then you can search with the name of your monitoring job, then, you can disable or delete it.

As you are a new user to Splunk Answers, you can upvote the answers/comments,
if this answer resolved your query, you can select this answer and "accept" it as the answer, so that this question will be moved to answered queue. Happy Splunking!

Re: how to cancel the monitoring job

johnsmithcy — Wed, 16 Jan 2019 06:08:49 GMT

I cant't find the monitoring job in "Searches, reports, and alerts". The job is about the CPU monitoring.
But I can find some of them in event type

Re: how to cancel the monitoring job

inventsekar — Wed, 16 Jan 2019 06:11:54 GMT

when you select "Searches, reports, and alerts",...there are 3 more tabs... "Type", "App", "Filter by Owner". did you select them appropriately?

Re: how to cancel the monitoring job

johnsmithcy — Wed, 16 Jan 2019 06:16:19 GMT

i select all for all 3 tabs, but I still can't find it.But I can find some of them in event type

Re: how to cancel the monitoring job

johnsmithcy — Wed, 16 Jan 2019 06:20:44 GMT

I added the monitoring by "add data" --> "monitor"
Is there any user guide to teach me the basics of splunk

Re: how to cancel the monitoring job

johnsmithcy — Fri, 18 Jan 2019 06:31:47 GMT

the source keep fetching data.... it is about cpu monitoring. Where can I cancel the source?

Re: how to cancel the monitoring job

johnsmithcy — Fri, 18 Jan 2019 06:46:38 GMT

Yes. My question should be "how to cancel the data source"

Re: how to cancel the monitoring job

bpadmanbhachari — Fri, 18 Jan 2019 08:01:08 GMT

if you want to stop the monitoring from the source >> On forwarder >> check for the monitoring stanza you have set under "inputs.conf" and disable it by giving disabled = 1 for that particular input alone, so that it will stop monitoring the inputs.