Splunk Search

srchMaxTime default unit in authorize.conf

splunkreal
Motivator

Hello guys,

is it OK to use srchMaxTime = 9000, it looks like it does 9000 seconds?

In authorize.conf doc it asks for srchMaxTime = <integer><unit>

We use Splunk Enterprise 7.1.4

Thanks.

* If this helps, please upvote or accept solution 🙂 *
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If the docs call for <integer><units> then I think it is not OK to use just <integer>. If you want a 90-second timeout then use srchMaxTime = 90s.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

If the docs call for <integer><units> then I think it is not OK to use just <integer>. If you want a 90-second timeout then use srchMaxTime = 90s.

---
If this reply helps you, Karma would be appreciated.

splunkreal
Motivator

We always used without unit and seemed to work anyway, thanks 🙂

* If this helps, please upvote or accept solution 🙂 *
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...