--- title: "Delete a Collector" method: DELETE path: "/lib/jobs/{id}" tags: ["collectors"] --- # Delete a Collector `DELETE /lib/jobs/{id}` Delete the specified Collector. ## Path parameters - `id` string, required ## Query parameters - `criblPack` string - `groupId` string ## Response `200` a list of SavedJob objects - CountedSavedJob - `count` integer — number of items present in the items array - `items` SavedJob[] - union - SavedJobCollection - `id` string — Unique ID for this Job - `description` string - `type` 'collection' | 'executor' | 'scheduledSearch', required - `ttl` string — Time to keep the job's artifacts on disk after job completion. This also affects how long a job is listed in the Job Inspector. - `ignoreGroupJobsLimit` boolean — When enabled, this job's artifacts are not counted toward the Worker Group's finished job artifacts limit. Artifacts will be removed only after the Collector's configured time to live. - `removeFields` string[] — List of fields to remove from Discover results. Wildcards (for example, aws*) are allowed. This is useful when discovery returns sensitive fields that should not be exposed in the Jobs user interface. - `resumeOnBoot` boolean — Resume the ad hoc job if a failure condition causes Stream to restart during job execution - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `schedule` ScheduleTypeSavedJobCollection — Configuration for a scheduled job - `enabled` boolean — Enable to configure scheduling for this Collector - `skippable` boolean — Skippable jobs can be delayed, up to their next run time, if the system is hitting concurrency limits - `resumeMissed` boolean — If Stream Leader (or single instance) restarts, run all missed jobs according to their original schedules - `cronSchedule` string — A cron schedule on which to run this job - `maxConcurrentRuns` number — The maximum number of instances of this scheduled job that may be running at any time - `run` RunSettingsTypeSavedJobCollectionSchedule - `type` 'collection' - `rescheduleDroppedTasks` boolean — Reschedule tasks that failed with non-fatal errors - `maxTaskReschedule` number — Maximum number of times a task can be rescheduled - `logLevel` 'error' | 'warn' | 'info' | 'debug' | 'silly' — Level at which to set task logging - `jobTimeout` string — Maximum time the job is allowed to run. Time unit defaults to seconds if not specified (examples: 30, 45s, 15m). Enter 0 for unlimited time. - `mode` string, required — Job run mode. Preview will either return up to N matching results, or will run until capture time T is reached. Discovery will gather the list of files to turn into streaming tasks, without running the data collection job. Full Run will run the collection job. - `timeRangeType` string - `earliest` number — Earliest time to collect data for the selected timezone - `latest` number — Latest time to collect data for the selected timezone - `timestampTimezone` unknown - `timeWarning` MetricsStore - `expression` string — A filter for tokens in the provided collect path and/or the events being collected - `minTaskSize` string — Limits the bundle size for small tasks. For example, if your lower bundle size is 1MB, you can bundle up to five 200KB files into one task. - `maxTaskSize` string — Limits the bundle size for files above the lower task bundle size. For example, if your upper bundle size is 10MB, you can bundle up to five 2MB files into one task. Files greater than this size will be assigned to individual tasks. - `streamtags` string[] — Tags for filtering and grouping in @{product} - `workerAffinity` boolean — If enabled, tasks are created and run by the same Worker Node - `collector` union, required — Collector configuration - CollectorAzureBlob — AzureBlob collector configuration - `type` 'azure_blob', required — Collector type - `conf` union, required — Collector configuration - … - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - CollectorCriblLake — CriblLake collector configuration - `type` 'cribl_lake', required — Collector type - `conf` object, required — Collector configuration - … - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - CollectorDatabase — Database collector configuration - `type` 'database', required — Collector type - `conf` object, required — Collector configuration - … - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - CollectorFilesystem — Filesystem collector configuration - `type` 'filesystem', required — Collector type - `conf` object, required — Collector configuration - … - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - CollectorGoogleCloudStorage — GoogleCloudStorage collector configuration - `type` 'google_cloud_storage', required — Collector type - `conf` union, required — Collector configuration - … - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - CollectorHealthCheck — HealthCheck collector configuration - `type` 'health_check', required — Collector type - `conf` union, required - … - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - CollectorRest — Rest collector configuration - `type` 'rest', required — Collector type - `conf` union, required - … - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - CollectorS3 — S3 collector configuration - `type` 's3', required — Collector type - `conf` union, required - … - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - CollectorScript — Script collector configuration - `type` 'script', required — Collector type - `conf` object, required — Collector configuration - … - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - CollectorSplunk — Splunk collector configuration - `type` 'splunk', required — Collector type - `conf` union, required — Collector configuration - … - `destructive` boolean — Delete any files collected (where applicable) - `encoding` string — Character encoding to use when parsing ingested data. - `input` TypeCollectionWithBreakerRulesetsConstraint - `type` 'collection' - `breakerRulesets` string[] — A list of event-breaking rulesets that will be applied, in order, to the input data stream - `staleChannelFlushMs` number — How long (in milliseconds) the Event Breaker will wait for new data to be sent to a specific channel before flushing the data stream out, as is, to the Pipelines - `sendToRoutes` boolean — Send events to normal routing and event processing. Disable to select a specific Pipeline/Destination combination. - `preprocess` PreprocessType - `disabled` boolean, required - `command` string — Command to feed the data through (via stdin) and process its output (stdout) - `args` string[] — Arguments to be added to the custom command - `throttleRatePerSec` string — Rate (in bytes per second) to throttle while writing to an output. Accepts values with multiple-byte units, such as KB, MB, and GB. (Example: 42 MB) Default value of 0 specifies no throttling. - `metadata` ItemsTypeMetadata[] — Fields to add to events from this input - `name` string, required - `value` string, required — JavaScript expression to compute field's value, enclosed in quotes or backticks. (Can evaluate to a constant.) - `pipeline` string — Pipeline to process results - `output` string — Destination to send results to - SavedJobExecutor - `id` string — Unique ID for this Job - `description` string - `type` 'collection' | 'executor' | 'scheduledSearch', required - `ttl` string — Time to keep the job's artifacts on disk after job completion. This also affects how long a job is listed in the Job Inspector. - `ignoreGroupJobsLimit` boolean — When enabled, this job's artifacts are not counted toward the Worker Group's finished job artifacts limit. Artifacts will be removed only after the Collector's configured time to live. - `removeFields` string[] — List of fields to remove from Discover results. Wildcards (for example, aws*) are allowed. This is useful when discovery returns sensitive fields that should not be exposed in the Jobs user interface. - `resumeOnBoot` boolean — Resume the ad hoc job if a failure condition causes Stream to restart during job execution - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `schedule` ScheduleTypeSavedJobCollection — Configuration for a scheduled job - `enabled` boolean — Enable to configure scheduling for this Collector - `skippable` boolean — Skippable jobs can be delayed, up to their next run time, if the system is hitting concurrency limits - `resumeMissed` boolean — If Stream Leader (or single instance) restarts, run all missed jobs according to their original schedules - `cronSchedule` string — A cron schedule on which to run this job - `maxConcurrentRuns` number — The maximum number of instances of this scheduled job that may be running at any time - `run` RunSettingsTypeSavedJobCollectionSchedule - `type` 'collection' - `rescheduleDroppedTasks` boolean — Reschedule tasks that failed with non-fatal errors - `maxTaskReschedule` number — Maximum number of times a task can be rescheduled - `logLevel` 'error' | 'warn' | 'info' | 'debug' | 'silly' — Level at which to set task logging - `jobTimeout` string — Maximum time the job is allowed to run. Time unit defaults to seconds if not specified (examples: 30, 45s, 15m). Enter 0 for unlimited time. - `mode` string, required — Job run mode. Preview will either return up to N matching results, or will run until capture time T is reached. Discovery will gather the list of files to turn into streaming tasks, without running the data collection job. Full Run will run the collection job. - `timeRangeType` string - `earliest` number — Earliest time to collect data for the selected timezone - `latest` number — Latest time to collect data for the selected timezone - `timestampTimezone` unknown - `timeWarning` MetricsStore - `expression` string — A filter for tokens in the provided collect path and/or the events being collected - `minTaskSize` string — Limits the bundle size for small tasks. For example, if your lower bundle size is 1MB, you can bundle up to five 200KB files into one task. - `maxTaskSize` string — Limits the bundle size for files above the lower task bundle size. For example, if your upper bundle size is 10MB, you can bundle up to five 2MB files into one task. Files greater than this size will be assigned to individual tasks. - `streamtags` string[] — Tags for filtering and grouping in @{product} - `executor` ExecutorTypeRunnableJobExecutor, required - `type` string, required — The type of executor to run - `storeTaskResults` boolean — Determines whether or not to write task results to disk - `conf` ExecutorSpecificSettingsTypeRunnableJobExecutorExecutor - SavedJobScheduledSearch - `id` string — Unique ID for this Job - `description` string - `type` 'collection' | 'executor' | 'scheduledSearch', required - `ttl` string — Time to keep the job's artifacts on disk after job completion. This also affects how long a job is listed in the Job Inspector. - `ignoreGroupJobsLimit` boolean — When enabled, this job's artifacts are not counted toward the Worker Group's finished job artifacts limit. Artifacts will be removed only after the Collector's configured time to live. - `removeFields` string[] — List of fields to remove from Discover results. Wildcards (for example, aws*) are allowed. This is useful when discovery returns sensitive fields that should not be exposed in the Jobs user interface. - `resumeOnBoot` boolean — Resume the ad hoc job if a failure condition causes Stream to restart during job execution - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere. - `schedule` ScheduleTypeSavedJobCollection — Configuration for a scheduled job - `enabled` boolean — Enable to configure scheduling for this Collector - `skippable` boolean — Skippable jobs can be delayed, up to their next run time, if the system is hitting concurrency limits - `resumeMissed` boolean — If Stream Leader (or single instance) restarts, run all missed jobs according to their original schedules - `cronSchedule` string — A cron schedule on which to run this job - `maxConcurrentRuns` number — The maximum number of instances of this scheduled job that may be running at any time - `run` RunSettingsTypeSavedJobCollectionSchedule - `type` 'collection' - `rescheduleDroppedTasks` boolean — Reschedule tasks that failed with non-fatal errors - `maxTaskReschedule` number — Maximum number of times a task can be rescheduled - `logLevel` 'error' | 'warn' | 'info' | 'debug' | 'silly' — Level at which to set task logging - `jobTimeout` string — Maximum time the job is allowed to run. Time unit defaults to seconds if not specified (examples: 30, 45s, 15m). Enter 0 for unlimited time. - `mode` string, required — Job run mode. Preview will either return up to N matching results, or will run until capture time T is reached. Discovery will gather the list of files to turn into streaming tasks, without running the data collection job. Full Run will run the collection job. - `timeRangeType` string - `earliest` number — Earliest time to collect data for the selected timezone - `latest` number — Latest time to collect data for the selected timezone - `timestampTimezone` unknown - `timeWarning` MetricsStore - `expression` string — A filter for tokens in the provided collect path and/or the events being collected - `minTaskSize` string — Limits the bundle size for small tasks. For example, if your lower bundle size is 1MB, you can bundle up to five 200KB files into one task. - `maxTaskSize` string — Limits the bundle size for files above the lower task bundle size. For example, if your upper bundle size is 10MB, you can bundle up to five 2MB files into one task. Files greater than this size will be assigned to individual tasks. - `streamtags` string[] — Tags for filtering and grouping in @{product} - `savedQueryId` string, required — Identifies which search query to run ## Other responses - `401` — Unauthorized - `500` — Unexpected error ## Changes - **2026-03-06** `11df16b26c1d` — 32 warning, 9 info - removed the optional property `items/items/oneOf[#/components/schemas/SavedJobCollection]/collector/oneOf[#/components/schemas/CollectorHealthCheck]/allOf[subschema #2]/conf/collectBody` from the response with the `200` status - removed the optional property `items/items/oneOf[#/components/schemas/SavedJobCollection]/collector/oneOf[#/components/schemas/CollectorHealthCheck]/allOf[subschema #2]/conf/collectRequestParams` from the response with the `200` status - removed the optional property `items/items/oneOf[#/components/schemas/SavedJobCollection]/collector/oneOf[#/components/schemas/CollectorHealthCheck]/allOf[subschema #2]/conf/discovery/allOf[subschema #1]/oneOf[#/components/schemas/HealthCheckDiscoveryDiscoverTypeHttp]/discoverBody` from the response with the `200` status - removed the optional property `items/items/oneOf[#/components/schemas/SavedJobCollection]/collector/oneOf[#/components/schemas/CollectorHealthCheck]/allOf[subschema #2]/conf/discovery/allOf[subschema #1]/oneOf[#/components/schemas/HealthCheckDiscoveryDiscoverTypeHttp]/discoverRequestParams` from the response with the `200` status - …37 more - **2026-01-24** `84748faee3ef` — 1 info - endpoint added - …this revision’s changelog is incomplete - **2026-01-19** `62472462b0c0` — 1 breaking - api path removed without deprecation - …this revision’s changelog is incomplete - …earlier changes not shown [Full history](https://skmtc.dev/criblio/apis/cribl-api-reference/changes/lib/jobs/:id/delete.md) --- [API](https://skmtc.dev/criblio/apis/cribl-api-reference.md) · [All operations](https://skmtc.dev/criblio/apis/cribl-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/criblio/cribl-api-reference/revisions/11df16b26c1d/schema)