QUEUED → PARSING → RUNNING → FINALIZING → DONE
                                        → FAILED
                 → PAUSED (on pause action)

# Create job
splunk-as job create "index=main | stats count by sourcetype" --earliest -1h
# Output: Job created: 1703779200.12345

# Check status
splunk-as job status 1703779200.12345
# Output: State: RUNNING, Progress: 45%, Events: 12345

# Wait for completion
splunk-as job poll 1703779200.12345 --timeout 300
# Output: Job completed: DONE, Results: 42

# Pause running job
splunk-as job pause 1703779200.12345

# Resume paused job
splunk-as job unpause 1703779200.12345

# Cancel job
splunk-as job cancel 1703779200.12345

# Finalize (stop and return current results)
splunk-as job finalize 1703779200.12345

# List all jobs
splunk-as job list
# Output: Table of active jobs with status

# Extend TTL (positional arg: SID TTL_VALUE)
splunk-as job ttl 1703779200.12345 3600

# Delete job
splunk-as job delete 1703779200.12345

# Available actions for /control endpoint
actions = ['cancel', 'pause', 'unpause', 'finalize', 'touch', 'setttl', 'enablepreview', 'disablepreview']

# POST /services/search/v2/jobs/{sid}/control
# data={'action': 'cancel'}