I want identify the long running searches who are running more than 5 min and stop them.
I'm able to find the long running searches from this command index=internal source=scheduler.log runtime=* | table savedsearchname, user, app, runtime, time | sort - runtime
But, I'm not able to find what is the way to stop them?
Q1. Is there search command I can use to stop the running searches?
Q2. Do I need to pass this result to script and call REST command to Splunkd to stop the running searches? If yes, what is the REST command to stop the searches?
Please do the needful.
Yes, there is a REST command to stop a running search.
Use this command to get a list of searches back:
curl -k -u admin:<pwd> https://localhost:8089/services/search/jobs/ | grep '<id>'
You can use the `` URL to cancel/delete this search like this:
curl -k -u admin:<pwd> --request DELETE https://localhost:8089/services/search/jobs/1416293763.77
and get back a response like this:
<?xml version="1.0" encoding="UTF-8"?> <response> <messages> <msg type="INFO">Search job cancelled.</msg> </messages> </response>
For more details have a look at the docs http://docs.splunk.com/Documentation/Splunk/6.2.0/RESTREF/RESTsearchExamples#search.2Fjobs.2F.7Bsear...
If you just need a nice table view of the running jobs, you can do this as well from the Splunk UI using this search:
| rest /services/search/jobs/ | table author, id
Hope this helps ...
there is actually a windows version of
curl available here https://curl.haxx.se/download.html or try this one https://superuser.com/questions/344927/powershell-equivalent-of-curl
Not a windows user so cannot be of much help here