Summarization timespan incongruent

[TiagoTLD1]

Hello,

I have a two environments with the exact same app and saved searches, and the exact same data

In environment 1, the summarization has timespans of 10min, 10s, 1d, 1h, 1min, 1s
In environment 2, the summarization timespans is just 1h.

Why would this happen? And why can't I, by changing the auto.summarize.timespan in the Advanced Edit of the savedsearches, actually change these to the timespans I want?

Thanks in advance

[DalJeanis]

You are looking exactly the right place... auto_summarize.timespan in savedsearches.conf in the two environments. Are you saying that you have tried to edit taht parameter and it had no effect? Or that you were unable to edit it, or it changed itself back? What's the actual issue?

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Manageacceleratedsearchsummaries#You_ca...

You can manually set summary timespans (but we don't recommend it)
You can set summary timespans manually at the report level in savedsearches.conf by changing the value of the auto_summarize.timespan parameter. If you do set your summary timespans manually, keep in mind that very small timespans can result in extremely slow summary creation times, especially if the summary range is long. On the other hand, large timespans can result in quick-building summaries that cannot not be used by reports with short time ranges. In almost all cases, for optimal performance and usability it's best to let Splunk software determine summary timespans.

[TiagoTLD1]

What I am facing is that eventhough I use the auto.summarize.timespan with value of 10s, Splunk still gives me the 1h timespan only.

It seems splunk is ignoring that rule. It doesn't matter what value I put there, it chooses 1h as the only timespan.

I understand that the customization is not recommended and I understand the risks, but at least it shoul allow the suggested parameter to actually have effects on the timespan, which it does not!