Delay configuration in data integrations

In live data mode the integration might need a delay to offset the query time windows to provide a time buffer and prevent retrieving partial real-time data.

The following table lists the environment variables for various integrations:

Integration environment variables
Integration Environment variable for Delay
Custom CUSTOM_QUERY_DELAY
ELK ELK_QUERY_DELAY
Falcon LogScale HUMIO_QUERY_DELAY
Mezmo MEZMO_QUERY_DELAY
PagerDuty PAGERDUTY_QUERY_DELAY
Splunk SPLUNK_QUERY_DELAY

To add delay settings in the Flink, open the configuration by using the following commands:

  • For PagerDuty:

    oc edit flinkdeployment aiops-lad-flink
    
  • For Falcon LogScale, Custom, Mezmo, ELK, and Splunk:

    oc edit deployment aimanager-aio-controller
    

    In the configuration, edit the env section.

    For example, set a 60-seconds delay for Splunk integration:

    env:
     - name: SPLUNK_QUERY_DELAY
       value: "60"
    

Note:

  • The values that are set in the configuration must be in seconds.
  • For existing integrations to pick up delay values, you must save the integrations again.
  • Delays are not applicable to historical mode integrations.