realtime searches canceled

[tmarlette]

I keep getting a message on top of my search app, that says:

"The running job "rt_1367002880.1350" was canceled or remotely expired"

I assume that this is because there was a realtime search that kept running after I left the page. I was wondering if anyone knew how to stop this, or at least see how many RT searches there are running and how I can stop them?

[emiller42 · Accepted solution]

to see your running jobs, click on 'Jobs' link in the upper right of the Splunk window. In the popup, change the 'App' and 'Owner' to 'All', and change the Status to 'Running'.

That will show you all running searches, along with their details.

[tmarlette]

I feel like an amateur... thank you sir!