topic Re: Is there a search or REST command to stop running searches forcefully? in Splunk Search

Is there a search or REST command to stop running searches forcefully?

splunk_worker — Mon, 28 Sep 2020 18:10:40 GMT

I want identify the long running searches who are running more than 5 min and stop them.

I'm able to find the long running searches from this command index=_internal source=scheduler.log run_time=* | table savedsearch_name, user, app, run_time, _time | sort - run_time

But, I'm not able to find what is the way to stop them?
Q1. Is there search command I can use to stop the running searches?
Q2. Do I need to pass this result to script and call REST command to Splunkd to stop the running searches? If yes, what is the REST command to stop the searches?

Please do the needful.

Re: Is there a search or REST command to stop running searches forcefully?

MuS — Tue, 18 Nov 2014 07:35:57 GMT

Hi splunk_worker,

Yes, there is a REST command to stop a running search.

Use this command to get a list of searches back:

curl -k -u admin:<pwd> https://localhost:8089/services/search/jobs/ | grep '<id>'

You can use the `` URL to cancel/delete this search like this:

curl -k -u admin:<pwd> --request DELETE https://localhost:8089/services/search/jobs/1416293763.77

and get back a response like this:

<?xml version="1.0" encoding="UTF-8"?>
<response>
  <messages>
    <msg type="INFO">Search job cancelled.</msg>
  </messages>
</response>

For more details have a look at the docs http://docs.splunk.com/Documentation/Splunk/6.2.0/RESTREF/RESTsearchExamples#search.2Fjobs.2F.7Bsearch_id.7D_DELETE

If you just need a nice table view of the running jobs, you can do this as well from the Splunk UI using this search:

| rest /services/search/jobs/ | table author, id

Hope this helps ...

cheers, MuS

Re: Is there a search or REST command to stop running searches forcefully?

damode — Tue, 24 Oct 2017 00:58:01 GMT

Hi @MuS,

Whats the Windows equivalent of the above curl command ?
Thanks

Re: Is there a search or REST command to stop running searches forcefully?

MuS — Tue, 24 Oct 2017 01:05:08 GMT

Hi damode,

there is actually a windows version of curl available here https://curl.haxx.se/download.html or try this one https://superuser.com/questions/344927/powershell-equivalent-of-curl

Not a windows user so cannot be of much help here ¯\_(ツ)_/¯

cheers, MuS

Re: Is there a search or REST command to stop running searches forcefully?

damode — Tue, 24 Oct 2017 02:57:08 GMT

Hi MuS,

Thanks for sharing the links.