Splunk Search
Highlighted

Is there a search or REST command to stop running searches forcefully?

Path Finder

Hi

I want identify the long running searches who are running more than 5 min and stop them.

I'm able to find the long running searches from this command index=internal source=scheduler.log runtime=* | table savedsearchname, user, app, runtime, time | sort - runtime

But, I'm not able to find what is the way to stop them?
Q1. Is there search command I can use to stop the running searches?
Q2. Do I need to pass this result to script and call REST command to Splunkd to stop the running searches? If yes, what is the REST command to stop the searches?

Please do the needful.

Highlighted

Re: Is there a search or REST command to stop running searches forcefully?

SplunkTrust
SplunkTrust

Hi splunk_worker,

Yes, there is a REST command to stop a running search.

Use this command to get a list of searches back:

curl -k -u admin:<pwd> https://localhost:8089/services/search/jobs/ | grep '<id>'

You can use the `` URL to cancel/delete this search like this:

curl -k -u admin:<pwd> --request DELETE https://localhost:8089/services/search/jobs/1416293763.77

and get back a response like this:

<?xml version="1.0" encoding="UTF-8"?>
<response>
  <messages>
    <msg type="INFO">Search job cancelled.</msg>
  </messages>
</response>

For more details have a look at the docs http://docs.splunk.com/Documentation/Splunk/6.2.0/RESTREF/RESTsearchExamples#search.2Fjobs.2F.7Bsear...

If you just need a nice table view of the running jobs, you can do this as well from the Splunk UI using this search:

| rest /services/search/jobs/ | table author, id

Hope this helps ...

cheers, MuS

View solution in original post

Highlighted

Re: Is there a search or REST command to stop running searches forcefully?

Builder

Hi @MuS,

Whats the Windows equivalent of the above curl command ?
Thanks

0 Karma
Highlighted

Re: Is there a search or REST command to stop running searches forcefully?

SplunkTrust
SplunkTrust

Hi damode,

there is actually a windows version of curl available here https://curl.haxx.se/download.html or try this one https://superuser.com/questions/344927/powershell-equivalent-of-curl

Not a windows user so cannot be of much help here ¯\_(ツ)_/¯

cheers, MuS

0 Karma
Highlighted

Re: Is there a search or REST command to stop running searches forcefully?

Builder

Hi MuS,

Thanks for sharing the links.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.