|
Is there a way to explicitly set the I'm doing a |
|
I did some more digging around the config files and it appears that I've mostly figured out how to do this. I found in the The comment in
In my case, I would like to disable all intermediate calculations, so I simply used the following setting in
However, this doesn't seem to work. The On a second test, I find out that using a non-0 value does work. The specific search I'm looking at is nearly always done in 120 seconds or less, so I set the value to
This does the trick. I can now see via the OS process list that my saved searches are being run with the new value. ( It looks like splunk is seeing |