.cancel
The .cancel command stops queued, running, or all queued and running searches.
.cancel ignores the set time range.
// cancel all running searches
.cancel running queries with(reason = "Time is up.")Purpose
Use .cancel to manage system resources and optimize performance by terminating queries that are no longer needed, taking too long, consuming too many resources, or made in error.
Permissions
| Search Member Type | Permissions |
|---|---|
| Admin | Can cancel all searches in their Organization. |
| Editor or User | Can cancel only their own searches. |
Syntax
.cancel query SearchId [with(reason = CancellationReason)]
Or:
.cancel Status queries
[by user (User[, ...])]
[with(reason = CancellationReason)]You can also combine this command with operators.
Parameters
| Parameter | Type | Description |
|---|---|---|
SearchId | string | The ID of the search to cancel. |
CancellationReason | string | The reason for running the .cancel command, which is added to the Cribl Search audit log. |
Status | string | The status of the queries to cancel:
|
User | string | The name of the user whose searches you want to cancel. |
Returns
Returns information about the canceled searches.
Examples
Cancel a specific search.
.cancel query "1693827597495.ji5y5g"Cancel searches queued or being run by specific users.
.cancel queries by user("John Doe", "Jane*") with(reason = "I don't need these searches.")Cancel all searches started by users whose names start with John or Jane.
.cancel queries by user("John*", "Jane*") with(reason = "Cleaning up.")Cancel queued searches that were created more than 10 minutes ago.
.cancel queued queries
| where timeCreated < ago(10min)