Splunk Search

srchMaxTime default unit in authorize.conf

realsplunk
Builder

Hello guys,

is it OK to use srchMaxTime = 9000, it looks like it does 9000 seconds?

In authorize.conf doc it asks for srchMaxTime = <integer><unit>

We use Splunk Enterprise 7.1.4

Thanks.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If the docs call for <integer><units> then I think it is not OK to use just <integer>. If you want a 90-second timeout then use srchMaxTime = 90s.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

If the docs call for <integer><units> then I think it is not OK to use just <integer>. If you want a 90-second timeout then use srchMaxTime = 90s.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

realsplunk
Builder

We always used without unit and seemed to work anyway, thanks 🙂

0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on