I have modified the xml of my dashboard in order to load some data directly form the results of the process related to a search. But the process will be cancelled in a week and it cannot last more than 7 days. How can I make longer the duration of this process?
Thank you everyone.
If you want to keep the results of a single job around indefinitely, I'd recommend writing its results into a lookup file using outputlookup
, or a summary index using collect
. That way you don't inadvertently lose your results either through the job timing out or someone cleaning out old dispatch artifacts.
If you want to periodically update the job, I'd recommend scheduling the search and referring to the saved search's name in your dashboard. That way you can let Splunk use a cached result from a scheduled job if it's available, or run a new job if there is no result available. See the cache element at http://docs.splunk.com/Documentation/Splunk/7.1.0/Viz/PanelreferenceforSimplifiedXML#search for more info.