Refine your search:

Can someone clarify what is meant by a "period"? Context is this:

"* If the integer is followed by the letter 'p' the ttl is interpreted as a multiple of the scheduled search's period."

I would interpret this as, if my scheduled search runs once per hour and I specify a period of 10p, that would mean my search artifact would survive for 10 hours.

asked 14 Jul '11, 10:07

the_wolverine's gravatar image

the_wolverine ♦
6.5k3932126
accept rate: 47%


One Answer:

Yes this is the meaning.

if a search runs every hour ( cron 0 * * ) with a ttl of 10p ( 10 periods), will store the results for 10 hours. FYI the default ttl is 2p.

link

answered 14 Oct '12, 22:12

yannK's gravatar image

yannK
20.7k21443
accept rate: 32%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×438
×331
×105

Asked: 14 Jul '11, 10:07

Seen: 897 times

Last updated: 14 Oct '12, 22:12

Copyright © 2005-2014 Splunk Inc. All rights reserved.