Splunk Search

Can anyone provide a link or documentation with definitions of what each job status means?

DFresh4130
Path Finder

I've tried searching the documentation with no luck. Can anyone provide a link that gives a definition of what each job status means? I'm trying to understand the difference between done and finished jobs.

Tags (3)
1 Solution

ChrisG
Splunk Employee
Splunk Employee

Done means the search is completed. If you stop the search before it is completed, then when it finishes stopping, it is finalized.

There is some relevant information buried in the REST API Reference: http://docs.splunk.com/Documentation/Splunk/6.2.2/RESTREF/RESTsearch#search.2Fjobs.

We could do a better job with that in the documentation. Thanks for pointing it out, a writer will work on it!

View solution in original post

ChrisG
Splunk Employee
Splunk Employee

Done means the search is completed. If you stop the search before it is completed, then when it finishes stopping, it is finalized.

There is some relevant information buried in the REST API Reference: http://docs.splunk.com/Documentation/Splunk/6.2.2/RESTREF/RESTsearch#search.2Fjobs.

We could do a better job with that in the documentation. Thanks for pointing it out, a writer will work on it!

DFresh4130
Path Finder

Thanks for updating the docs. Can you elaborate on which statuses count toward a concurrent search limit?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Do you mean Done and Finalized? Below are valid job status values

QUEUED 
PARSING 
RUNNING 
PAUSED 
FINALIZING 
FAILED 
DONE 

DFresh4130
Path Finder

Correct. I often see my concurrent search limit of 10 searches being hit, but when I go to view jobs and sort by all running ones I only see 2 or 3 most of the time. Trying to understand what each of these means and see if that's what's causing me to hit the limit so often.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...