Splunk Search

length of RT searches?

tmarlette
Motivator

I am attempting to find out how long a RT search will go for before it simply stops.

If I crank up my session time-out time to say 30 days, and I am to run an RT search all that time, would it be live or time out?

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

See the answer below. (replace property name POLLER_INACTIVITY_TIMEOUT with ui_inactivity_timeout)

http://answers.splunk.com/answers/3408/best-practice-for-keeping-my-real-time-dashboard-running-inde...

The realtime search should run indefinitely till the browser is closed.

View solution in original post

somesoni2
Revered Legend

See the answer below. (replace property name POLLER_INACTIVITY_TIMEOUT with ui_inactivity_timeout)

http://answers.splunk.com/answers/3408/best-practice-for-keeping-my-real-time-dashboard-running-inde...

The realtime search should run indefinitely till the browser is closed.

somesoni2
Revered Legend

In Splunk Web -> Manager -> General Setting -> Session Timeout, could you see/set the appropriate values (30d).

0 Karma

tmarlette
Motivator

The use case is exactly the same. I have a NOC that is watching these dashboards. What would I set it to? I set it to 43200 (30 days) but the UI seemed to spaz out when I did. the Search head seemed like it lost connectivity to the indexer every time I moved the mouse.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...