I've messed my Splunk system up a bit and some jobs or searches (I don't remember) are continuously running (every minute I think). This causes my CPU to rise to 100% a few seconds after splunkd starts. Unfortunately, I don't have time to stop them or edit them from Splunk Web.
Are the jobs stored in any config file? I would like to edit them so I can change the frequency to 24h or so.
Right now I'm stuck and can't do anything.
You can access all your saved searches in the Splunk web interface (The GUI).. Go to the top left where it says
Activity then select
Jobs and this will show all the searches that are running
Look for a file: savedsearches.conf inside of an app/local directory: (like etc/apps/search/local)
Thanks! Found it under C:\Program Files\Splunk\etc\users\admin\search\local