Hi,
in the app there are all saved searches enabled by default and fact that are scheduled to run way too often with | outputlookup ... is causing bundle replication all the time.
it is not good from performance point of view to replicate bundle every few minutes around the clock.
Addon was recently installed on fresh splunk installation and caused pause whole replication bundle. After disabling the searches issue was solved.
It would be nice if searches are disabled by default and let users enable them (i would say best practice), or change schedule to run less often like once a day or so.
Thanks.
Hi,
in the app there are all saved searches enabled by default and fact that are scheduled to run way too often with | outputlookup ... is causing bundle replication all the time.
it is not good from performance point of view to replicate bundle every few minutes around the clock.
Addon was recently installed on fresh splunk installation and caused pause whole replication bundle. After disabling the searches issue was solved.
It would be nice if searches are disabled by default and let users enable them (i would say best practice), or change schedule to run less often like once a day or so.
Thanks.