Hi,
We use splunk's scripted authentication mechanism in our product. Initially we set the cachetiming to 1s. Since its adding lot of load on the system, we wanted to increase the polling time intervals to 10 min. While going through the documentation i noticed that for setting time in minutes its given as
min(s) in http://docs.splunk.com/Documentation/Splunk/6.0.3/Admin/Authenticationconf
m in http://docs.splunk.com/Documentation/Splunk/6.1.2/Security/Editauthenticationconf
Which one is right?
Thanks
Strive
These searches are equivalent:
index=_internal earliest=-15m latest=now
index=_internal earliest=-15min latest=now
index=_internal earliest=-15mins latest=now
index=_internal earliest=-15minute latest=now
index=_internal earliest=-15minutes latest=now
So I assume the configuration might work the same in accepting all five ways of expression the minute unit.
These searches are equivalent:
index=_internal earliest=-15m latest=now
index=_internal earliest=-15min latest=now
index=_internal earliest=-15mins latest=now
index=_internal earliest=-15minute latest=now
index=_internal earliest=-15minutes latest=now
So I assume the configuration might work the same in accepting all five ways of expression the minute unit.
I tried with unit as 'm' and it seems to be working