Can anyone provide a link or documentation with definitions of what each job status means?

[DFresh4130]

I've tried searching the documentation with no luck. Can anyone provide a link that gives a definition of what each job status means? I'm trying to understand the difference between done and finished jobs.

[ChrisG · Accepted solution]

Done means the search is completed. If you stop the search before it is completed, then when it finishes stopping, it is finalized.

There is some relevant information buried in the REST API Reference: http://docs.splunk.com/Documentation/Splunk/6.2.2/RESTREF/RESTsearch#search.2Fjobs.

We could do a better job with that in the documentation. Thanks for pointing it out, a writer will work on it!

[ChrisG]

Docs are updated! http://docs.splunk.com/Documentation/Splunk/6.2.2/Knowledge/ViewsearchjobpropertieswiththeJobInspect...

[DFresh4130]

Thanks for updating the docs. Can you elaborate on which statuses count toward a concurrent search limit?

[somesoni2]

Do you mean Done and Finalized? Below are valid job status values

QUEUED 
PARSING 
RUNNING 
PAUSED 
FINALIZING 
FAILED 
DONE 

[DFresh4130]

Correct. I often see my concurrent search limit of 10 searches being hit, but when I go to view jobs and sort by all running ones I only see 2 or 3 most of the time. Trying to understand what each of these means and see if that's what's causing me to hit the limit so often.