Splunk Search

Process end with load job

brober27
New Member

I have modified the xml of my dashboard in order to load some data directly form the results of the process related to a search. But the process will be cancelled in a week and it cannot last more than 7 days. How can I make longer the duration of this process?
Thank you everyone.

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

If you want to keep the results of a single job around indefinitely, I'd recommend writing its results into a lookup file using outputlookup, or a summary index using collect. That way you don't inadvertently lose your results either through the job timing out or someone cleaning out old dispatch artifacts.

If you want to periodically update the job, I'd recommend scheduling the search and referring to the saved search's name in your dashboard. That way you can let Splunk use a cached result from a scheduled job if it's available, or run a new job if there is no result available. See the cache element at http://docs.splunk.com/Documentation/Splunk/7.1.0/Viz/PanelreferenceforSimplifiedXML#search for more info.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...

Keep the Learning Going with the New Best of .conf Hub

Hello Splunkers, With .conf26 getting closer, there’s already a lot of excitement building around this year’s ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...