Splunk Search

Cannot use auto_finalize_ec in search

Jaci
Splunk Employee
Splunk Employee

I find the document about auto finalize in this page http://zh-hant.splunk.com/base/Documentation/latest/Developer/RESTSearch.

I use the parameter auto_finalize_ec = integer like "https://splunk-server:8000/en-US/app/search/flashtimeline?auto_finalize_ec=5000&q=search%20index%3D*" and it does not work. But when I use the parameter auto_pause in the same document like "https://splunk-server:8000/en-US/app/search/flashtimeline?auto_pause=true&q=search%20index%3D*" I works.

Please tell me, why it's not working and how can I do it to work.

Tags (3)
1 Solution

sideview
SplunkTrust
SplunkTrust

The auto_finalize_ec parameter is in splunkd's REST API, but there is no way to use it from the UI.

from the UI Im sure you know this already but you can of course put a | head 1000 after your search. And if you're dealing with a report, inserting that same | head 1000 at the last point in the search where your rows are still events.

there is a 'max_count' parameter that can be used on the HiddenSearch module only (still not in the view URLs though). Download the ui_examples app and read through the section under "Advanced XML > Affecting Search Performance". In the fifth view in that section, I talk about some somewhat limited ways in which you can use the max_count parameter on HiddenSearch to make a view that terminates very quickly.

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

The auto_finalize_ec parameter is in splunkd's REST API, but there is no way to use it from the UI.

from the UI Im sure you know this already but you can of course put a | head 1000 after your search. And if you're dealing with a report, inserting that same | head 1000 at the last point in the search where your rows are still events.

there is a 'max_count' parameter that can be used on the HiddenSearch module only (still not in the view URLs though). Download the ui_examples app and read through the section under "Advanced XML > Affecting Search Performance". In the fifth view in that section, I talk about some somewhat limited ways in which you can use the max_count parameter on HiddenSearch to make a view that terminates very quickly.

0 Karma

Jaci
Splunk Employee
Splunk Employee

Thank you for the response!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...