Splunk Search

Instead of using Job Manager, rest call to kill/stop all running current adhoc jobs for one user?

Path Finder

Does anyone know of a rest call that can be used to kill all adhoc queries for a user?  I do not wish to all users searches, nor do I want to kill schedule searches for that user.

I have the following rest query to identify the current running query for Running_man.

| rest /services/search/jobs/
| search author=Running_man dispatchState=RUNNING
| search NOT id=*scheduler*
| table title id normalizedSearch runDuration

I just would like to be able to kill/stop the results found versus having to go into the job manager.

Labels (1)
0 Karma


Hi @john_glasscock 

You can try following Rest API, action: cancel . Doc link - Search endpoint descriptions - Splunk Documentation

curl -k -u admin:pass https://localhost:8089/services/search/jobs/mysearch_02151949/control -d action=pause


An upvote would be appreciated if it helps!

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>