Currently on 6.4.3 which the docs claim this setting should be available for. Simply put, I've tried setting it both to true and 1, restarted splunk on the searchhead afterward, under shclustering stanza in .../system/local/server.conf, yet when I check the audit logs I can see the hosts I've marked this setting on are still running saved searches. Is there something I'm missing, or something else I can check to see why this is?
↧