I did some more digging around the config files and it appears that I've mostly figured out how to do this. I found in the $SPLUNK_HOME/etc/system/default/savedsearches.conf a global entry dispatch.reduce_freq = 10, which looks exactly like what I'm looking for.
The comment in limits.conf for the reduce_freq setting states:
the frequency with which try to reduce intermediate data when there is an non-streaming and non-stateful streaming command. (0 = never)
In my case, I would like to disable all intermediate calculations, so I simply used the following setting in savedsearches.conf:
dispatch.reduce_freq = 0
However, this doesn't seem to work. The reduce_freq stayed with the default value of 10,
On a second test, I find out that using a non-0 value does work. The specific search I'm looking at is nearly always done in 120 seconds or less, so I set the value to 180 to effectively disable this functionality. My entry now looks like this:
dispatch.reduce_freq = 180
This does the trick. I can now see via the OS process list that my saved searches are being run with the new value. ( ps aux | grep "splunkd search". The commands now show --reduce_freq=180 instead of --reduce_freq=10).
It looks like splunk is seeing dispatch.reduce_freq=0 the same as dispatch.reduce_freq=; both of which simply use the established default value. I'm not sure if this is a bug or a feature.
