How can search results be kept longer than 7 days?
How can search results be kept longer than 7 days?
To keep search results longer than 7 days, one must schedule a report. This process allows the results to be saved and accessed beyond the default maximum retention time of an ad-hoc search job, which is up to 7 days.
Guys, here keyword is longer than 7 days. changing job settings will allow only up to 7 days so if you want to go more than that then you have to schedule a report.
Exactly
Agree it can be longer than 7 days by scheduling a report
A is correct • Lifetime – Default is 10 minutes – Can be extended to 7 days – To keep your search results longer, schedule a report
A is correct
The keyword is 7 days.
https://docs.splunk.com/Documentation/Splunk/7.2.6/Search/Extendjoblifetimes Ad-hoc search, can only retain results either 10min or 7days Only Scheduled searches can extend the search result beyond 7 days. "By default, these jobs are retained for the interval of the scheduled search multiplied by two."
Correct answer is A. Schedule as a report. Edit on Job settings only has a max of 7 days and the question says more than 7 days
A is correct
Page 70.. PDF File Answer is A
if : A is correct, like per page 70 from PDF ( can somebody add the link to this PDF file) thanks
A is correct
A is correct
Select Edit Job Settings to display the Job Settings.
A is correct ans
A is correct, you have to schedule a report.
A is the one you want to go fors
A is correct
Its A, Page 70 of Splunk official guide
I have my doubts, Splunk say: You change the lifetime setting for the current ad hoc search job in the Search app. 1. Select the Job drop-down. 2. Select Edit Job Settings to display the Job Settings. 3. For Lifetime, select either 10 Minutes or 7 Days.
Yes that is correct. Up to 7 days you can do that. The question is linger than 7 days. Fun1 pdf page 70.
A is correct, page 70 from PDF
Scheduling a report in Splunk allows you to extend the retention period of search results beyond the default 7 days.