Select timing for configuration refresh
In version 5.0.2 and earlier, the defaults for synchronizing from the storage location were set to very frequent intervals. This could lead to excessive time spent reading configuration changes from the pool, particularly in deployments with large numbers of users (in the hundreds or thousands).
The default settings have been changed to less frequent intervals starting with 5.0.3. In server.conf, the following settings affect configuration refresh timing:
# 5.0.3 defaults [pooling] poll.interval.rebuild = 1m poll.interval.check = 1m
The previous defaults for these settings were 2s and 5s, respectively.
With the old default values, a change made on one search head would become available on another search head at most seven seconds later. There is usually no need for updates to be propagated that quickly. By changing the settings to values of one minute, the load on the shared storage system is greatly reduced. Depending on your business needs, you might be able to set these values to even longer intervals.
| Deployment server and search head pooling | Upgrade a search head pool |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9
Download manual
Feedback submitted, thanks!