Integer or relative time expression No refresh Indicate a delay or interval time for inline or saved searches. This setting does not apply to post-process searches, which refresh automatically when their base search refreshes.
Integers are handled as seconds. Use SPL syntax for relative time expressions. For example, 1h5m or 5m.
Use the <refreshType> setting to specify refresh behavior in relation to search completion or dispatch.
You can use the <refresh.display> setting in a visualization to specify a refresh progress indicator.
interval or delay delay Indicate the starting time for counting down to a refresh. Use delay to start counting when the search is done.
Use interval to count down when the search is dispatched. If the runtime of the search is longer than the configured time, the search job is cancelled and a new job is dispatched.