Splunk Search

Searches and reports Cache

Path Finder

How to clean Searches and reports cache?

I just rename stanza from [Report TEST] to [Report All Users] in my savedsearches.conf but that report on email is still under name 'Report TEST'!!!

After research all my savedsearches.conf files I saw that I have another [Report TEST] and my new one [Report All Users] with the same parameters and search!

/opt/splunk/etc/apps/search/local/savedsearches.conf

[Report TEST]
alert.suppress = 0
alert.track = 1
counttype = number of events
cron_schedule = */10 * * * *
dispatch.earliest_time = -10m@m
dispatch.latest_time = now
enableSched = 1
quantity = 0
relation = greater than
search = index=myindex sourcetype=mysourcetype test1

/opt/splunk/etc/apps/search/local/savedsearches.conf

[Report All Users]
alert.suppress = 0
alert.track = 1
counttype = number of events
cron_schedule = */10 * * * *
dispatch.earliest_time = -10m@m
dispatch.latest_time = now
enableSched = 1
quantity = 0
relation = greater than
search = index=myindex sourcetype=mysourcetype test1

'Report TEST' works but 'Report All Users' don't!!!! Why?????

Tags (3)
0 Karma

Contributor

Restart your splunk to reload new configure file

0 Karma

Path Finder

Restart did not help!

0 Karma