After we deleted a job it popped back up -- How can we delete it for good?

[ddrillic]

For some reason, we are not able to delete expired jobs as admin and as a power user who owns the jobs.

We choose, Job and then Delete Job. A pop message appears and disappears for a brief moment and the job remains with us.

Any ideas?

[landen99]

Transfer Captain to clean-up captain's old and outdated search artifact records by going to Settings-Search Head Cluster under Distributed Environment and choosing the new captain to transfer to.

[mayurr98]

Look this link
https://answers.splunk.com/answers/29551/too-many-search-jobs-found-in-the-dispatch-directory.html

let me know if it works for you!

[ddrillic]

Not sure about the relation here ; -)

[teunlaan]

What version are you running? Do you run a SH cluster?

We see the same issue in our SHclluster. It is releated with syncing betweens de SH's.
You're search is probably already deleted form te SH that was running it, but the Captain doesn't know that.
The "popup" is that it can't find the Job-ID.

We "Fix" it by selecting an other SH as master. Usually it will clean up after a while

[mika703]

That solved my issue, thanks. i also checked Splunk Known Issues and found the official Issue ID which is known since 2014

2014-10-02

SPL-91638, SPL-107375

For scheduled searches in a search head cluster, empty search jobs may appear in the job inspector for a cluster member.

[ddrillic]

Very interesting - have you filed any bug report on that, by any chance?

[ddrillic]

Let's see what Support would say...