KB 136 - New summary lookup for Landscape Overview
KB 136 - New summary lookup for Landscape Overview
Category: Problem/Information/Recommendation | Priority: Normal |
|---|---|
Platform: Splunk | Version: 1 from 23.03.2021 |
Description
Landscape Overview Dashboard uses “landscape_overview_summary_lookup” to populate the overview panel. There are 2 savedsearches which are useful to manage this lookup.
The savedsearches can be seen from the following page: Click on Settings -> “Searches,reports, and alerts”.
“landscape_overview_summary” savedsearch which is running at every hour is ingesting data into the lookup and this savedsearch collects data for the last 60 minutes.
“landscape_overview_lookup_clean” savedsearch is useful for removing the data from lookup and this savedsearch is running every day. The user can configure the number of days data he/she wants to retain in the lookup. The default and recommended value is 30 days. Follow the below steps to configure: :
Click on Settings -> “Advanced search” -> “Search macros”.
Search for “pc_landscape_lookup_delete_days”
Click on “pc_landscape_lookup_delete_days” and set the definition as a numeric value