A oneshot search is a synchronous REST call (execmode=oneshot) that waits for the search to finish before returning. When the job completes, every result is delivered in the HTTP response—effectively “streaming” the full result set back to the caller in one shot. The response format is chosen with the outputmode parameter, which explicitly supports csv among other formats. Because a oneshot search never creates a persistent search job, job-oriented controls such as autocancel are not accepted, and the search is not executed asynchronously.

A. Oneshot blocks until completion; asynchronous jobs use normal /search/jobs with execmode=normal or blocking=0.

D. autocancel is a parameter for background search jobs; the /search/jobs/oneshot endpoint does not recognise it.

1. Splunk Enterprise REST API Reference 9.1

endpoint /services/search/jobs/oneshot – Description: “Blocks until the search completes… returns the results.”

2. Ibid.

Parameter list – outputmode: “csv | json | xml …”.

3. Splunk Developer Guide (“Managing Search Jobs”

§ Oneshot Searches)

para 1: “Oneshot searches return all results synchronously in the same response.”

4. Splunk Enterprise REST API Reference 9.1

endpoint /services/search/jobs – parameter autocancel (absent from oneshot spec)

confirming it is only for standard jobs.