Skip to content

Commit 9ed36ee

Browse files
authored
Update savedsearches.conf
1 parent 6a638cc commit 9ed36ee

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

default/savedsearches.conf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6207,7 +6207,7 @@ quantity = 0
62076207
relation = greater than
62086208
request.ui_dispatch_app = SplunkAdmins
62096209
request.ui_dispatch_view = search
6210-
search = ```This warning when occurring repetitively tends to indicate some kind of issue that will require the file to be manually removed. For example a zero sized metadata file that cannot be reaped by the dispatch reaper``` \
6210+
search = ```This alert attempts to find peers that are relatively slow compared to other peers. I've used a hardcoded time rather than a variable as it appeared to work well. ``` \
62116211
index=_internal `indexerhosts` source=*remote_searches.log terminated: OR closed: \
62126212
| regex search!="^(pretypeahead|copybuckets)" \
62136213
| rex "(?s) elapsedTime=(?P<elapsedTime>[0-9\.]+),( cpuTime=\S+,)? search='(?P<search>.*?)(', savedsearch_name|\", drop_count=\d+)" \

0 commit comments

Comments
 (0)