You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
90 lines
2.3 KiB
90 lines
2.3 KiB
[datamodels://Splunk_SA_CIM]
|
|
blacklist = Certificates \
|
|
| Splunk_CIM_Validation \
|
|
| Interprocess_Messaging \
|
|
| Intrusion_Detection \
|
|
| Databases \
|
|
| Malware \
|
|
| Performance \
|
|
| Updates \
|
|
| Web
|
|
|
|
[datamodels://SA-ThreatIntelligence]
|
|
blacklist = Risk
|
|
|
|
|
|
[cloud]
|
|
show_migration_message = 1
|
|
|
|
[backup_restore]
|
|
# Jobs queued should timeout if owning node has been down (for the last 12 hours (half a day = 43200 seconds) by default)
|
|
job_queue_timeout = 43200
|
|
|
|
[import]
|
|
import_batch_size = 1000
|
|
preview_sample_limit = 100
|
|
asynchronous_processing_threshold = 100
|
|
enable_empty_replace = 0
|
|
|
|
[metric_backfill]
|
|
# The size of pre-calculation window for metric backfill. The smallest value is 1(s). Changing it to a larger value
|
|
# will make the backfill search faster, but less accurate
|
|
pre_calculation_window = 1
|
|
|
|
[synced_kpi_scheduling]
|
|
disabled = 1
|
|
|
|
[customsearch]
|
|
timeout_read = 3600
|
|
|
|
[episode_action_dispatch]
|
|
role = both
|
|
remote_ea_mgmt_uri =
|
|
remote_ea_username =
|
|
remote_ea_search_timeout = 120
|
|
|
|
[lock]
|
|
service_template_sync_in_progress = 0
|
|
|
|
[object_batch_sizes]
|
|
# These sizes are the number of objects in a batch.
|
|
default = 1000
|
|
# These objects are roughly 10 KB in size each. Making batch size greater than 10k will negatively impact performance
|
|
entity = 10000
|
|
# These objects are not expected to surpass 2 MB in size each
|
|
entity_filter_rule = 250
|
|
service = 250
|
|
# These objects are not expected to surpass 20 MB in size each
|
|
glass_table = 25
|
|
# These objects are roughly 5 KB in size each. Making batch size greater than 10k will negatively impact performance
|
|
kpi_entity_threshold = 10000
|
|
# These objects are roughly 5 KB in size each. Making batch size greater than 10k will negatively impact performance
|
|
kpi_at_info = 10000
|
|
|
|
|
|
[rest]
|
|
# Time out value for the rest calls.
|
|
rest_timeout = 300
|
|
|
|
[upgrade_readiness]
|
|
# Define threshold to be used in prechecks
|
|
large_number_of_kpis_per_base_search_threshold = 600
|
|
dangling_service_reference_in_entities_disabled = 0
|
|
|
|
[applyat]
|
|
# The number of KPIs to include in each batch sent to the applyat search command
|
|
kpi_level_batch_size = 1000
|
|
entity_level_batch_size = 1000
|
|
batch_timeout = 3600
|
|
|
|
[apply_dst_to_at]
|
|
disabled = 1
|
|
timezone =
|
|
offset = 0
|
|
|
|
[upgrade_timeouts]
|
|
# Timeouts values for different stages of upgrade
|
|
precheck_timeout=1800
|
|
migration_timeout=14400
|
|
upgrade_timeout=18000
|