Archive

Process end with load job

New Member

I have modified the xml of my dashboard in order to load some data directly form the results of the process related to a search. But the process will be cancelled in a week and it cannot last more than 7 days. How can I make longer the duration of this process?
Thank you everyone.

Tags (1)
0 Karma

SplunkTrust
SplunkTrust

If you want to keep the results of a single job around indefinitely, I'd recommend writing its results into a lookup file using outputlookup, or a summary index using collect. That way you don't inadvertently lose your results either through the job timing out or someone cleaning out old dispatch artifacts.

If you want to periodically update the job, I'd recommend scheduling the search and referring to the saved search's name in your dashboard. That way you can let Splunk use a cached result from a scheduled job if it's available, or run a new job if there is no result available. See the cache element at http://docs.splunk.com/Documentation/Splunk/7.1.0/Viz/PanelreferenceforSimplifiedXML#search for more info.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!