Only applies in non-digest mode alerting. Maximum number of alerts to trigger for each saved search instance (or real-time results preview for RT alerts). The maximum number of rows that will be rendered for a table within integrated PDF rendering. When non-zero, the point at which kv stops creating new fields. The maximum number of fields that an automatic key-value field extraction (auto kv) can generate at search time. A value of 0 means that no truncation occurs. Truncate _raw to this size and then do auto KV. Maximum search time, in seconds, before auto-finalization of subsearch. The maximum number of result rows to output from subsearch to join against. The table shows editable nf settings by stanza, with minimum, maximum, and default values:
#Splunk lookup max limit how to#
This section shows you how to view and edit select nf settings using Splunk Web. The Configure limits UI does not currently support AWS GovCloud or FedRAMP environments.Ĭhanging nf settings can affect the performance of your Splunk Cloud Platform deployment. Your deployment must have one or more separate search heads or a search head cluster.Automatic UI updates and token authentication must be enabled for your deployment.See Determine your Splunk Cloud Platform Experience. Your Splunk Cloud Platform deployment must be on Victoria Experience.You must have Splunk Cloud Platform version.The sc_admin role includes this capability by default. You must have the edit_limits_conf capability.For more information, see Manage nf configurations in Splunk Cloud Platform in the Admin Config Service Manual.
You can use the Configure limits page in Splunk Web to view and edit nf settings, without assistance from Splunk Support.Īlternatively, you can configure nf settings programmatically using the Admin Config Service (ACS) API.
Splunk Cloud Platform supports self-service configuration of select nf settings, which can be useful for optimizing search performance.
0 kommentar(er)
