admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added enableSched = 1 to baseline searches

Browse Source
This commit is contained in:
David Dorsey
2020-11-09 22:23:43 -06:00
parent bf21ee071f
commit 941bbf9de7
1 changed files with 1 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/jinja2_templates/savedsearches.j2
+1 -2
View File
@@ -79,8 +79,6 @@ action.email.useNSSubject = 1
{% endif %}
{% endif %}
alert.digest_mode = 1
action.escu.earliest_time_offset = 3600
action.escu.latest_time_offset = 86400
disabled = true
enableSched = 1
counttype = number of events
@@ -116,6 +114,7 @@ action.escu.data_models = [{{ baseline.data_model | tojson }}]
action.escu.data_models = []
{% endif %}
cron_schedule = {{ baseline.deployment.scheduling.cron_schedule }}
enableSched = 1
dispatch.earliest_time = {{ baseline.deployment.scheduling.earliest_time }}
dispatch.latest_time = {{ baseline.deployment.scheduling.latest_time }}
{% if baseline.deployment.scheduling.schedule_window is defined %}