I am doing a simple search:
index=pqr host=xyz* NOT TYPE="*ABCDE*" | fields X, Y | timechart limit=0 span=10m count, avg(X) by Y
on a two week period.
The search has been running for more than two hours now and is still only at about 60%. Is there a way to make it run faster?
Also sometimes I get
> 'search has been remotely> cancelled or expired'
What does that mean? how do I prevent a search from getting cancelled?
↧