splunk-job

Name: splunk-job
Author: grandcamel

15stars3forks

How to install splunk-job?

grandcamel/splunk-assistant-skills/splunk-job

$npx -y skills add grandcamel/Splunk-Assistant-Skills --skill splunk-job

Installs into the current project.

Summary

Search job lifecycle orchestration for Splunk.

Files · 1

View on GitHub

SKILL.md

1	# splunk-job
2
3	Search job lifecycle orchestration for Splunk.
4
5	## Purpose
6
7	Manage the complete lifecycle of Splunk search jobs including creation, monitoring, control actions (pause/cancel/finalize), and cleanup.
8
9	## Risk Levels
10
11	\| Operation \| Risk \| Notes \|
12	\|-----------\|------\|-------\|
13	\| Get job status \| - \| Read-only \|
14	\| List jobs \| - \| Read-only \|
15	\| Create job \| - \| Easily reversible via cancel \|
16	\| Pause/unpause job \| ⚠️ \| Can be undone \|
17	\| Finalize job \| ⚠️ \| Returns partial results \|
18	\| Cancel job \| ⚠️ \| Stops execution \|
19	\| Delete job \| ⚠️⚠️ \| Removes job and results \|
20
21	## Triggers
22
23	- "job", "search job", "SID"
24	- "status", "progress", "state"
25	- "cancel", "pause", "unpause", "finalize"
26	- "list jobs", "delete job"
27
28	## Job States (dispatchState)
29
30	```
31	QUEUED → PARSING → RUNNING → FINALIZING → DONE
32	→ FAILED
33	→ PAUSED (on pause action)
34	```
35
36	\| State \| Description \|
37	\|-------\|-------------\|
38	\| QUEUED \| Job waiting in queue \|
39	\| PARSING \| SPL being parsed \|
40	\| RUNNING \| Search executing \|
41	\| FINALIZING \| Results being finalized \|
42	\| DONE \| Completed successfully \|
43	\| FAILED \| Error occurred \|
44	\| PAUSED \| Paused by user \|
45
46	## CLI Commands
47
48	\| Command \| Description \|
49	\|---------\|-------------\|
50	\| `job create` \| Create search job, return SID \|
51	\| `job status` \| Get dispatchState, progress, stats \|
52	\| `job poll` \| Wait for job completion with timeout \|
53	\| `job cancel` \| Issue /control/cancel action \|
54	\| `job pause` \| Issue /control/pause action \|
55	\| `job unpause` \| Issue /control/unpause action \|
56	\| `job finalize` \| Issue /control/finalize action \|
57	\| `job ttl` \| Set job time-to-live \|
58	\| `job touch` \| Touch a job to extend its TTL \|
59	\| `job list` \| List all search jobs for user \|
60	\| `job delete` \| Remove job from dispatch directory \|
61
62	## Examples
63
64	### Create and Monitor Job
65
66	```bash
67	# Create job
68	splunk-as job create "index=main \| stats count by sourcetype" --earliest -1h
69	# Output: Job created: 1703779200.12345
70
71	# Check status
72	splunk-as job status 1703779200.12345
73	# Output: State: RUNNING, Progress: 45%, Events: 12345
74
75	# Wait for completion
76	splunk-as job poll 1703779200.12345 --timeout 300
77	# Output: Job completed: DONE, Results: 42
78	```
79
80	### Job Control
81
82	```bash
83	# Pause running job
84	splunk-as job pause 1703779200.12345
85
86	# Resume paused job
87	splunk-as job unpause 1703779200.12345
88
89	# Cancel job
90	splunk-as job cancel 1703779200.12345
91
92	# Finalize (stop and return current results)
93	splunk-as job finalize 1703779200.12345
94	```
95
96	### Job Management
97
98	```bash
99	# List all jobs
100	splunk-as job list
101	# Output: Table of active jobs with status
102
103	# Extend TTL (positional arg: SID TTL_VALUE)
104	splunk-as job ttl 1703779200.12345 3600
105
106	# Delete job
107	splunk-as job delete 1703779200.12345
108	```
109
110	## API Endpoints
111
112	\| Endpoint \| Method \| Description \|
113	\|----------\|--------\|-------------\|
114	\| `/services/search/v2/jobs` \| POST \| Create job \|
115	\| `/services/search/v2/jobs/{sid}` \| GET \| Get job status \|
116	\| `/services/search/v2/jobs/{sid}/control` \| POST \| Control actions \|
117	\| `/services/search/jobs` \| GET \| List jobs \|
118	\| `/services/search/jobs/{sid}` \| DELETE \| Delete job \|
119
120	## Control Actions
121
122	```python
123	# Available actions for /control endpoint
124	actions = ['cancel', 'pause', 'unpause', 'finalize', 'touch', 'setttl', 'enablepreview', 'disablepreview']
125
126	# POST /services/search/v2/jobs/{sid}/control
127	# data={'action': 'cancel'}
128	```
129
130	## Job Properties
131
132	\| Property \| Description \|
133	\|----------\|-------------\|
134	\| `sid` \| Search job ID \|
135	\| `dispatchState` \| Current state \|
136	\| `doneProgress` \| Completion 0.0-1.0 \|
137	\| `eventCount` \| Events scanned \|
138	\| `resultCount` \| Results produced \|
139	\| `scanCount` \| Buckets scanned \|
140	\| `runDuration` \| Execution time \|
141	\| `ttl` \| Time to live \|
142	\| `isFailed` \| Failure flag \|
143	\| `isPaused` \| Pause flag \|
144
145	## Best Practices
146
147	1. Always set time bounds in the search query
148	2. Use appropriate timeout for poll_job.py
149	3. Cancel jobs when results are no longer needed
150	4. Monitor progress for long-running searches
151	5. Extend TTL for jobs you need to keep
152
153	## Related Skills
154
155	- [splunk-search](../splunk-search/SKILL.md) - Query execution
156	- [splunk-export](../splunk-export/SKILL.md) - Result extraction

People who liked this also viewed

6 picks

Type

azure-kustoQuery and analyze data in Azure Data Explorer (Kusto/ADX) using KQL for log analytics, telemetry, and time series analysis. WHEN: KQL queries, Kusto database queries, Azure Data Explorer, ADX clustersSkillsJul 2026470k1.3k
lark-base飞书多维表格（Base）操作：建表、字段、记录、视图、统计、公式/lookup、表单、仪表盘、workflow、角色权限；遇到 Base/多维表格/bitable 或 /base/ 链接时使用。文件导入转 lark-drive，认证/授权转 lark-shared。SkillsJul 2026382k16k
lark-calendar飞书日历：管理日历日程和会议室。查看/搜索日程、创建/更新日程、管理参会人、查询忙闲和推荐时段、预定会议室。当用户需要查看日程安排、创建/修改会议、查询/预定会议室时使用。不负责：查询过去的视频会议记录（走 lark-vc）、待办任务（走 lark-task）。SkillsJul 2026380k16k
shadcnManages shadcn components and projects — adding, searching, fixing, debugging, styling, and composing UI, including chat interfaces. Provides project context, component docs, and usage examples. AppliSkillsJul 2026246k120k
xlsxUse this skill any time a spreadsheet file is the primary input or output. This means any task where the user wants to: open, read, edit, or fix an existing .xlsx, .xlsm, .xltx, .csv, or .tsv file (e.SkillsJul 2026139k163k
firebase-data-connectAgent Skills for FirebaseSkillsJul 2026108k387

splunk-job

15stars3forks

View on GitHub

How to install splunk-job?

grandcamel/splunk-assistant-skills/splunk-job

$npx -y skills add grandcamel/Splunk-Assistant-Skills --skill splunk-job

Installs into the current project.

Summary

Search job lifecycle orchestration for Splunk.

Files · 1

View on GitHub

SKILL.md

1	# splunk-job
2
3	Search job lifecycle orchestration for Splunk.
4
5	## Purpose
6
7	Manage the complete lifecycle of Splunk search jobs including creation, monitoring, control actions (pause/cancel/finalize), and cleanup.
8
9	## Risk Levels
10
11	\| Operation \| Risk \| Notes \|
12	\|-----------\|------\|-------\|
13	\| Get job status \| - \| Read-only \|
14	\| List jobs \| - \| Read-only \|
15	\| Create job \| - \| Easily reversible via cancel \|
16	\| Pause/unpause job \| ⚠️ \| Can be undone \|
17	\| Finalize job \| ⚠️ \| Returns partial results \|
18	\| Cancel job \| ⚠️ \| Stops execution \|
19	\| Delete job \| ⚠️⚠️ \| Removes job and results \|
20
21	## Triggers
22
23	- "job", "search job", "SID"
24	- "status", "progress", "state"
25	- "cancel", "pause", "unpause", "finalize"
26	- "list jobs", "delete job"
27
28	## Job States (dispatchState)
29
30	```
31	QUEUED → PARSING → RUNNING → FINALIZING → DONE
32	→ FAILED
33	→ PAUSED (on pause action)
34	```
35
36	\| State \| Description \|
37	\|-------\|-------------\|
38	\| QUEUED \| Job waiting in queue \|
39	\| PARSING \| SPL being parsed \|
40	\| RUNNING \| Search executing \|
41	\| FINALIZING \| Results being finalized \|
42	\| DONE \| Completed successfully \|
43	\| FAILED \| Error occurred \|
44	\| PAUSED \| Paused by user \|
45
46	## CLI Commands
47
48	\| Command \| Description \|
49	\|---------\|-------------\|
50	\| `job create` \| Create search job, return SID \|
51	\| `job status` \| Get dispatchState, progress, stats \|
52	\| `job poll` \| Wait for job completion with timeout \|
53	\| `job cancel` \| Issue /control/cancel action \|
54	\| `job pause` \| Issue /control/pause action \|
55	\| `job unpause` \| Issue /control/unpause action \|
56	\| `job finalize` \| Issue /control/finalize action \|
57	\| `job ttl` \| Set job time-to-live \|
58	\| `job touch` \| Touch a job to extend its TTL \|
59	\| `job list` \| List all search jobs for user \|
60	\| `job delete` \| Remove job from dispatch directory \|
61
62	## Examples
63
64	### Create and Monitor Job
65
66	```bash
67	# Create job
68	splunk-as job create "index=main \| stats count by sourcetype" --earliest -1h
69	# Output: Job created: 1703779200.12345
70
71	# Check status
72	splunk-as job status 1703779200.12345
73	# Output: State: RUNNING, Progress: 45%, Events: 12345
74
75	# Wait for completion
76	splunk-as job poll 1703779200.12345 --timeout 300
77	# Output: Job completed: DONE, Results: 42
78	```
79
80	### Job Control
81
82	```bash
83	# Pause running job
84	splunk-as job pause 1703779200.12345
85
86	# Resume paused job
87	splunk-as job unpause 1703779200.12345
88
89	# Cancel job
90	splunk-as job cancel 1703779200.12345
91
92	# Finalize (stop and return current results)
93	splunk-as job finalize 1703779200.12345
94	```
95
96	### Job Management
97
98	```bash
99	# List all jobs
100	splunk-as job list
101	# Output: Table of active jobs with status
102
103	# Extend TTL (positional arg: SID TTL_VALUE)
104	splunk-as job ttl 1703779200.12345 3600
105
106	# Delete job
107	splunk-as job delete 1703779200.12345
108	```
109
110	## API Endpoints
111
112	\| Endpoint \| Method \| Description \|
113	\|----------\|--------\|-------------\|
114	\| `/services/search/v2/jobs` \| POST \| Create job \|
115	\| `/services/search/v2/jobs/{sid}` \| GET \| Get job status \|
116	\| `/services/search/v2/jobs/{sid}/control` \| POST \| Control actions \|
117	\| `/services/search/jobs` \| GET \| List jobs \|
118	\| `/services/search/jobs/{sid}` \| DELETE \| Delete job \|
119
120	## Control Actions
121
122	```python
123	# Available actions for /control endpoint
124	actions = ['cancel', 'pause', 'unpause', 'finalize', 'touch', 'setttl', 'enablepreview', 'disablepreview']
125
126	# POST /services/search/v2/jobs/{sid}/control
127	# data={'action': 'cancel'}
128	```
129
130	## Job Properties
131
132	\| Property \| Description \|
133	\|----------\|-------------\|
134	\| `sid` \| Search job ID \|
135	\| `dispatchState` \| Current state \|
136	\| `doneProgress` \| Completion 0.0-1.0 \|
137	\| `eventCount` \| Events scanned \|
138	\| `resultCount` \| Results produced \|
139	\| `scanCount` \| Buckets scanned \|
140	\| `runDuration` \| Execution time \|
141	\| `ttl` \| Time to live \|
142	\| `isFailed` \| Failure flag \|
143	\| `isPaused` \| Pause flag \|
144
145	## Best Practices
146
147	1. Always set time bounds in the search query
148	2. Use appropriate timeout for poll_job.py
149	3. Cancel jobs when results are no longer needed
150	4. Monitor progress for long-running searches
151	5. Extend TTL for jobs you need to keep
152
153	## Related Skills
154
155	- [splunk-search](../splunk-search/SKILL.md) - Query execution
156	- [splunk-export](../splunk-export/SKILL.md) - Result extraction

People who liked this also viewed

6 picks

Type