There are no predefined hooks in the interface. However, you should be able to detect when a search process has been paused / finalized / canceled by periodically looking for sentinel files (with the same names) in the search's dispatch dir $SPLUNK_HOME/var/run/splunk/dispatch/<sid> The search process when: paused: will stop reading from the stdin pipe (and the ERP's stdout writes will block until unpaused) finalized / canceled: will close the stdin pipe (and ERP's stdout writes will fail with broken pipe) ... View more