Update savedsearches.conf

Author: gjanders

default/savedsearches.conf

@@ -4952,7 +4952,7 @@ quantity = 0
 relation = greater than
 request.ui_dispatch_app = SplunkAdmins
 request.ui_dispatch_view = search
-search = ```Attempt to detect bundle issues on any member of the search head cluster for an extended period of time. It can fail per-member if distsearch is customised``` index=_internal `searchheadhosts` sourcetype=splunkd `splunkadmins_splunkd_source` "Gave up waiting for the captain to establish a common bundle version" OR "Cannot determine a latest common bundle" OR (log_level=WARN AND component=DistributedBundleReplicationManager ```This is confirmed as an invalid warning message in Splunk 9``` NOT "Failed to touch bundle=, checksum=0 (manual preparation): No such file or directory") NOT "large lookup file" ``` relates to The current bundle directory contains a large lookup file that might cause bundle replication fail ``` \
+search = ```Attempt to detect bundle issues on any member of the search head cluster for an extended period of time. It can fail per-member if distsearch is customised``` index=_internal `searchheadhosts` sourcetype=splunkd `splunkadmins_splunkd_source` "Gave up waiting for the captain to establish a common bundle version" OR "Cannot determine a latest common bundle" OR (log_level=WARN AND component=DistributedBundleReplicationManager ```This is confirmed as an invalid warning message in Splunk 9``` NOT "Failed to touch bundle=, checksum=0 (manual preparation): No such file or directory"  ``` relates to "The current bundle directory contains a large lookup file that might cause bundle replication fail" ``` NOT "large lookup file")  \
 | search ```Exclude shutdown times``` NOT [`splunkadmins_shutdown_time(indexerhosts,0,0)`]\
 | timechart span=5m count by host\
 | fillnull\