Solved: srchMaxTime default unit in authorize.conf

splunkreal · ‎05-20-2020

Hello guys,

is it OK to use srchMaxTime = 9000, it looks like it does 9000 seconds?

In authorize.conf doc it asks for srchMaxTime = <integer><unit>

We use Splunk Enterprise 7.1.4

Thanks.

* If this helps, please upvote or accept solution if it solved *

richgalloway · ‎05-20-2020

If the docs call for <integer><units> then I think it is not OK to use just <integer>. If you want a 90-second timeout then use srchMaxTime = 90s.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway · ‎05-20-2020

If the docs call for <integer><units> then I think it is not OK to use just <integer>. If you want a 90-second timeout then use srchMaxTime = 90s.

---
If this reply helps you, Karma would be appreciated.

splunkreal · ‎05-20-2020

We always used without unit and seemed to work anyway, thanks 🙂

* If this helps, please upvote or accept solution if it solved *

srchMaxTime default unit in authorize.conf

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

Your summer travels continue with new course releases

Are you a member of the Splunk Community?

srchMaxTime default unit in authorize.conf

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

Your summer travels continue with new course releases