is it OK to use srchMaxTime = 9000, it looks like it does 9000 seconds?
In authorize.conf doc it asks for srchMaxTime = <integer><unit>
srchMaxTime = <integer><unit>
We use Splunk Enterprise 7.1.4
If the docs call for <integer><units> then I think it is not OK to use just <integer>. If you want a 90-second timeout then use srchMaxTime = 90s.
srchMaxTime = 90s
View solution in original post
We always used without unit and seemed to work anyway, thanks 🙂