Splunk Search

Process end with load job

brober27
New Member

I have modified the xml of my dashboard in order to load some data directly form the results of the process related to a search. But the process will be cancelled in a week and it cannot last more than 7 days. How can I make longer the duration of this process?
Thank you everyone.

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

If you want to keep the results of a single job around indefinitely, I'd recommend writing its results into a lookup file using outputlookup, or a summary index using collect. That way you don't inadvertently lose your results either through the job timing out or someone cleaning out old dispatch artifacts.

If you want to periodically update the job, I'd recommend scheduling the search and referring to the saved search's name in your dashboard. That way you can let Splunk use a cached result from a scheduled job if it's available, or run a new job if there is no result available. See the cache element at http://docs.splunk.com/Documentation/Splunk/7.1.0/Viz/PanelreferenceforSimplifiedXML#search for more info.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...