Splunk Search

How to Disable auto-run when changing mode or time in Search view?

rajbeerdhatt
Explorer

Context: New Search View.  I am not referring to Dashboards (which have many auto-run posts).

I often develop searches in Verbose mode over a very small timespan, then move to Fast mode over a large timespan (Smart mode doesn't work well for me).

What drives me crazy is when I either change the mode or select a time preset, the Splunk UI automatically begins a search. I want to change both the mode and the timespan before starting a search.  

Is there a way to disable automatically running search -- so that it only runs a search after an explicit "enter" / search button click?



Labels (1)

VatsalJagani
SplunkTrust
SplunkTrust

@rajbeerdhatt - I don't think there is currently any option you can set in Splunk.

But you can submit your idea of enhancement here - https://ideas.splunk.com/ideas

---
Consider upvoting if this is helpful!!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...