capabilities.work

Finalize, Read, and Clean Up a Search Job

A 4-step recipe with Splunk. We can help you get access.

Recipe · 4 steps

Finalize, Read, and Clean Up a Search Job

with Splunk · Observability Management

Create, finalize, read, and delete a search job.

  1. Dispatch the SPL search as an asynchronous search job and capture the assigned search ID (sid).
  2. Issue the finalize control action to stop the search from collecting more data while preserving the results gathered so far.
  3. Retrieve the results gathered before the job was finalized.
  4. Cancel and delete the search job to release search-head resources.
What you'll need to have ready
  • search: The SPL search query to execute.
  • earliest_time: Earliest time boundary for the search.
  • latest_time: Latest time boundary for the search.
  • count: Maximum number of results to return.
For your developer

Arazzo workflow splunk:control-and-cleanup-search, 4 operations: createSearchJob → controlSearchJob → getSearchResults → deleteSearchJob. Specs on APIs.io.

More recipes with Splunk

HEC Ingest an Event and Confirm IndexingProvision an Index and Attach a Monitor InputIngest Raw Data then Search for ItRun a Search Job and Retrieve ResultsSearch and Retrieve Raw Events