How to tell what searches are running currently

[thepocketwade]

I want to avoid killing somebody else's search in the event I need to restart splunk. Is there any way to see all the searches being run right now in Splunk 4?

[gkanapathy]

And in Windows you can look in the Task Manager (or use Process Explorer, or whatever) and look for instances of splunk-search.exe

[kbecker]

If you are running Splunk on Linux you can also execute "ps -ef | grep search" from the command line.

[tpaulsen]

But that only applies to Splunk 4.

[jrodman]

To add on to this comparison: the splunk-specific monitoring does know more about the searches, but the operating-system level inspection is an intended feature. If something is misbehaving, we want the tradiditional tools to be informative. renicing jobs is kosher, as is a goold old SIGQUIT, in a pinch. The windows equivalents should also be fine.

[thepocketwade]

That would certainly work, but you jobs tab in the ui gives the percentage complete. So, you could just watch the search finish before restarting, instead of rerunning ps.

[Mick · Accepted solution]

As an admin user, you can click on 'Jobs' in the top right hand corner of the UI and see all searches that are currently running

[bhawkins1]

In splunk 6, "Jobs" is under the "Activity" heading.