From 57e1bc878fef30a2fee2b50db0fb33bf3282ed9f Mon Sep 17 00:00:00 2001 From: Gareth Anderson Date: Thu, 3 Oct 2024 15:13:27 +1000 Subject: [PATCH] Update savedsearches.conf --- default/savedsearches.conf | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/default/savedsearches.conf b/default/savedsearches.conf index 40d47a4..4245360 100644 --- a/default/savedsearches.conf +++ b/default/savedsearches.conf @@ -8741,10 +8741,7 @@ disabled = 1 action.email.useNSSubject = 1 alert.track = 0 cron_schedule = 38 * * * * -description = Report only? Yes. This report attempts to report the job performance per indexer of any particular SID related to handoff time. This is useful to determine if indexers which are not optimised out of the search are causing performance issues for queries. This is visible in the job inspector once the setting is enabled (no restart required). You will need to change this to the correct sid, and you will need to enable this setting: \ -[search_metrics] \ -debug_metrics=true \ -in limits.conf +description = Report only? Yes. This report attempts to report the job performance per indexer of any particular SID related to handoff time. This is useful to determine if indexers which are not optimised out of the search are causing performance issues for queries. This is visible in the job inspector once the setting is enabled (no restart required). You will need to change this to the correct sid, and you will need to enable this setting: [search_metrics] debug_metrics=true in limits.conf dispatch.earliest_time = -65m@m dispatch.latest_time = -5m@m display.events.fields = ["index","sourcetype","host"]