Splunk timeout parameter vs. manual cancellation for distributed searches
Operational constraint An API service submits long-running searches to a distributed Splunk deployment and must release search resources without relying on user intervention. Assuming Splunk Enterprise 7.2 or later, the Search Jobs API provides a timeout parameter, while /services/search/jobs/{id}/cancel supports explicit cancellation of a running job. The d
splunk