All Apps and Add-ons

System Tagger for McAfee ePO's jobs are incomplete due to maximum amount of time allowed

evelenke
Contributor

Hi Splunkers,

we try to integrate System Tagger for McAfee ePO to apply tags in ePO DB.
But the result is always incomplete - f.e. lt only 17 records were tagged from 300 required.
It seems that the root cause was found in a scheduler.log "

Reached maximum amount of time allowed to spend in per-result alerts... max_alerts_time=300 (seconds), fired_alerts=17

So I have 2 questions:

  1. Is it normal that only 15-20 records may be tagged during 5 minutes?
  2. How to increase the maximum amount of time allowed to spend in per-result alerts?
0 Karma

evelenke
Contributor

Resolved with adding to system/local/limits.conf:

[scheduler]
max_per_result_alerts_time = 0

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...