topic Is there a way to set the job TTL to a different value for a saved search? in Other Usage https://community.splunk.com/t5/Other-Usage/Is-there-a-way-to-set-the-job-TTL-to-a-different-value-for-a/m-p/171807#M47 <P>Is there a way to set the job ttl to a different value for a saved search? </P> Tue, 05 Aug 2014 19:02:29 GMT bohrasaurabh 2014-08-05T19:02:29Z Is there a way to set the job TTL to a different value for a saved search? https://community.splunk.com/t5/Other-Usage/Is-there-a-way-to-set-the-job-TTL-to-a-different-value-for-a/m-p/171807#M47 <P>Is there a way to set the job ttl to a different value for a saved search? </P> Tue, 05 Aug 2014 19:02:29 GMT https://community.splunk.com/t5/Other-Usage/Is-there-a-way-to-set-the-job-TTL-to-a-different-value-for-a/m-p/171807#M47 bohrasaurabh 2014-08-05T19:02:29Z Re: Is there a way to set the job TTL to a different value for a saved search? https://community.splunk.com/t5/Other-Usage/Is-there-a-way-to-set-the-job-TTL-to-a-different-value-for-a/m-p/171808#M48 <P>I guess you can update savedsearches.conf file for that saved search and set the dispatch.ttl to your configured value. Is that what you're looking for?</P> Tue, 05 Aug 2014 19:32:07 GMT https://community.splunk.com/t5/Other-Usage/Is-there-a-way-to-set-the-job-TTL-to-a-different-value-for-a/m-p/171808#M48 somesoni2 2014-08-05T19:32:07Z Re: Is there a way to set the job TTL to a different value for a saved search? https://community.splunk.com/t5/Other-Usage/Is-there-a-way-to-set-the-job-TTL-to-a-different-value-for-a/m-p/171809#M49 <P>dispatch.ttl for savedsearch is different from jobs ttl. my understanding is jobs ttl defines how long the job will be in jobs activity.</P> Tue, 05 Aug 2014 21:24:09 GMT https://community.splunk.com/t5/Other-Usage/Is-there-a-way-to-set-the-job-TTL-to-a-different-value-for-a/m-p/171809#M49 bohrasaurabh 2014-08-05T21:24:09Z Re: Is there a way to set the job TTL to a different value for a saved search? https://community.splunk.com/t5/Other-Usage/Is-there-a-way-to-set-the-job-TTL-to-a-different-value-for-a/m-p/171810#M50 <P>This will help.<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.1.2/Knowledge/SupervisejobswiththeJobspage#Search_job_lifespans">http://docs.splunk.com/Documentation/Splunk/6.1.2/Knowledge/SupervisejobswiththeJobspage#Search_job_lifespans</A></P> Tue, 05 Aug 2014 21:30:09 GMT https://community.splunk.com/t5/Other-Usage/Is-there-a-way-to-set-the-job-TTL-to-a-different-value-for-a/m-p/171810#M50 somesoni2 2014-08-05T21:30:09Z Re: Is there a way to set the job TTL to a different value for a saved search? https://community.splunk.com/t5/Other-Usage/Is-there-a-way-to-set-the-job-TTL-to-a-different-value-for-a/m-p/171811#M51 <P>bohrasaurabh gave you the answer, edit your search (in savedsearches.conf) As a line like:</P> <P>dispatch.ttl = 3600</P> <P>Note that the time is in seconds</P> Thu, 14 Aug 2014 12:35:29 GMT https://community.splunk.com/t5/Other-Usage/Is-there-a-way-to-set-the-job-TTL-to-a-different-value-for-a/m-p/171811#M51 guilmxm 2014-08-14T12:35:29Z Re: Is there a way to set the job TTL to a different value for a saved search? https://community.splunk.com/t5/Other-Usage/Is-there-a-way-to-set-the-job-TTL-to-a-different-value-for-a/m-p/171812#M52 <P>Yes, the TTL setting for the alert overrides the setting in savedsearches.conf, but you should set the TTL in both places. The TTL in alert_actions.conf only applies if an alert is triggered, otherwise the TTL in savedsearches.conf applies.</P> <P>In both places, you can use the p notation or just the number of seconds to save.</P> <P>There are also settings for TTL in limits.conf, but those only apply to ad hoc searches.</P> Tue, 20 Sep 2016 08:21:21 GMT https://community.splunk.com/t5/Other-Usage/Is-there-a-way-to-set-the-job-TTL-to-a-different-value-for-a/m-p/171812#M52 risgupta_splunk 2016-09-20T08:21:21Z Re: Is there a way to set the job TTL to a different value for a saved search? https://community.splunk.com/t5/Other-Usage/Is-there-a-way-to-set-the-job-TTL-to-a-different-value-for-a/m-p/171813#M53 <P>Note that you can also specify the value as <CODE>[0-9]+p</CODE>, e.g. <CODE>dispatch.ttl = 7p</CODE> - this means "save 7 versions of the saved search".</P> <P>You can then use old searches with, for example <CODE>| loadjob savedsearch="x:y:z" artifact_offset=3</CODE></P> Fri, 03 Feb 2017 09:47:22 GMT https://community.splunk.com/t5/Other-Usage/Is-there-a-way-to-set-the-job-TTL-to-a-different-value-for-a/m-p/171813#M53 bhawkins1 2017-02-03T09:47:22Z Re: Is there a way to set the job TTL to a different value for a saved search? https://community.splunk.com/t5/Other-Usage/Is-there-a-way-to-set-the-job-TTL-to-a-different-value-for-a/m-p/634492#M54 <P>You can also use "| noop set_ttl = &lt;NumberOfSecondsHere&gt;"</P> Wed, 15 Mar 2023 00:55:26 GMT https://community.splunk.com/t5/Other-Usage/Is-there-a-way-to-set-the-job-TTL-to-a-different-value-for-a/m-p/634492#M54 woodcock 2023-03-15T00:55:26Z