There are two primary methods to retrieve a list of search jobs in Splunk. The first is through the Splunk Web user interface by navigating to the Activity > Jobs menu. This page displays a list of running, paused, and completed search jobs initiated by the user (or all users for administrators). The second method is programmatic, using the Splunk REST API. A GET request to the /services/search/jobs endpoint returns a collection of search jobs, providing detailed information about each job's status and properties.

C. The /services/saved/searches endpoint lists saved search configurations (the search string, schedule, etc.), not the running or completed search jobs that result from them.

D. The /services/search/sid/results endpoint is used to retrieve the results of a single, specific search job identified by its Search ID (SID), not to get a list of multiple jobs.

1. Splunk Enterprise Documentation

Search Manual

"Manage search jobs": This document explicitly states the UI path for viewing jobs. "You can view and manage your search jobs from the Jobs page in Splunk Web. To open the Jobs page

click Activity > Jobs." (Splunk Enterprise 9.x

Search Manual

Chapter: "Managing search jobs").

2. Splunk Enterprise Documentation

REST API Reference Manual

"search/jobs": This reference details the /services/search/jobs endpoint. For a GET request

it states its purpose is to "Return the collection of search jobs." (Splunk Enterprise 9.x

REST API Reference Manual

Endpoints: search/jobs).

3. Splunk Enterprise Documentation

REST API Reference Manual

"saved/searches": This reference clarifies the purpose of the /services/saved/searches endpoint is to "access saved searches

" which are the search definitions

not the jobs themselves. (Splunk Enterprise 9.x

REST API Reference Manual

Endpoints: saved/searches).