We have a distributed environment, and a lot of people have searches set to run every 15 minutes. This is leading to a huge spike in searches every 15 minutes. Is there a way to specify the Schedule Window to default to auto or 5 minutes, and allow overrides manually as needed?
https://docs.splunk.com/Documentation/Splunk/6.5.2/Report/PrioritizescheduledreportsinSplunkWeb mentioned the possibility of auto, but I haven't seen that option in Splunk Web. I haven't seen anything that says that you can set a default option for that setting.
Thank you for any information you can provide.
Thanks
-Jeff
↧