Splunk Search

Process end with load job

brober27
New Member

I have modified the xml of my dashboard in order to load some data directly form the results of the process related to a search. But the process will be cancelled in a week and it cannot last more than 7 days. How can I make longer the duration of this process?
Thank you everyone.

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

If you want to keep the results of a single job around indefinitely, I'd recommend writing its results into a lookup file using outputlookup, or a summary index using collect. That way you don't inadvertently lose your results either through the job timing out or someone cleaning out old dispatch artifacts.

If you want to periodically update the job, I'd recommend scheduling the search and referring to the saved search's name in your dashboard. That way you can let Splunk use a cached result from a scheduled job if it's available, or run a new job if there is no result available. See the cache element at http://docs.splunk.com/Documentation/Splunk/7.1.0/Viz/PanelreferenceforSimplifiedXML#search for more info.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...