How to stop scheduled searches
You can stop the Data monitoring app from running scheduled searches. To disable scheduled searches:
- Go to Settings > Searches, reports, and alerts to open the Searches, reports and alerts page.
- Select the following search criteria:
- Type = "All"
- App = "Data monitoring"
- Owner = "Nobody"
- In the resulting list, locate "gdi_summarizer_ingestion_volume".
- Click Edit and select "Disable".
This will stop the scheduled searches and metrics will no longer be ingested into the gdi_summary_metrics index. Note that when you enable scheduled searches again, Data monitoring will not backfill the data for the time it was disabled. This means that there might be gaps in metrics reporting as you query the data on the dashboards.
To enable saved searches:
- Go to Settings > Searches, reports, and alerts to open the Searches, reports and alerts page.
- Select the following search criteria:
- Type = "All"
- App = "Data monitoring"
- Owner = "Nobody"
- In the resulting list, locate "gdi_summarizer_ingestion_volume".
- Click Edit and select "Enable".
Install the Data monitoring preview app | Working with the Data monitoring dashboard |
This documentation applies to the following versions of Splunk® Enterprise: DataMonitoringAppPreview
Feedback submitted, thanks!