REST API does not finalize searches in parsing state

Applicability

Splunk Enterprise

Description

As per the REST API Reference Manual, it is possible to stop searches using the 'finalize' action.

In an environment with multiple searches running more than 24 hours, the REST API is used to stop these searches that do not produce results in such a long time. The command used is this:

curl method=post uri=https://localhost:8801/services/search/jobs/$sid$/control splunkauth=true data=\"action=finalize\"

However, this command succeeds with most of the searches but fails to stop the searches that are in the parsing state. Those ones need to be stopped killing the OS process.

Investigation

The CONTROL endpoint accepts a list of actions (pause | unpause | finalize | cancel | touch | setttl | setpriority | enablepreview | disablepreview | setworkloadpool)

finalize: Stops the search, and provides intermediate results to the /results endpoint.

When a search is raised from a SH, the SH parses it into distributed and centralized parts that later on will be sent to the indexers. At that point, the search has not produced any result yet so the 'finalize' action will not be able to provide intermediate results. 

However, the action 'cancel' works fine for searches in the parsing state. That action stops the search and does not return results. 

cancel: Stops the current search and deletes the result cache.

 

Resolution

For searches in the parsing state, this command will stop the job correctly.

curl method=post uri=https://localhost:8801/services/search/jobs/$sid$/control splunkauth=true data=\"action=cancel\"

Related Links

Splunk Documentation

REST API Reference Manual

RESTsearch

Revision History

Revision	Publish Date	Comments
1.0	28-Sep-2026	Initial Release