Cannot use auto_finalize_ec in search

[Jaci]

I find the document about auto finalize in this page http://zh-hant.splunk.com/base/Documentation/latest/Developer/RESTSearch.

I use the parameter auto_finalize_ec = integer like "https://splunk-server:8000/en-US/app/search/flashtimeline?auto_finalize_ec=5000&q=search%20index%3D*" and it does not work. But when I use the parameter auto_pause in the same document like "https://splunk-server:8000/en-US/app/search/flashtimeline?auto_pause=true&q=search%20index%3D*" I works.

Please tell me, why it's not working and how can I do it to work.

[sideview · Accepted solution]

The auto_finalize_ec parameter is in splunkd's REST API, but there is no way to use it from the UI.

from the UI Im sure you know this already but you can of course put a | head 1000 after your search. And if you're dealing with a report, inserting that same | head 1000 at the last point in the search where your rows are still events.

there is a 'max_count' parameter that can be used on the HiddenSearch module only (still not in the view URLs though). Download the ui_examples app and read through the section under "Advanced XML > Affecting Search Performance". In the fifth view in that section, I talk about some somewhat limited ways in which you can use the max_count parameter on HiddenSearch to make a view that terminates very quickly.

[Jaci]

Thank you for the response!