https://community.splunk.com/t5/Reporting/How-to-Set-Expiry-Time-for-Saved-Scheduled-Search-Results-to-7/m-p/688950#M12490 <P>If you click - go into to the saved search, there is a setting called 'Job Settings',&nbsp; in there is another setting called 'lifetime', this has a setting of 10 minutes or 7 days, perhaps this will help you.&nbsp;&nbsp;</P> Wed, 29 May 2024 06:24:08 GMT deepakc 2024-05-29T06:24:08Z https://community.splunk.com/t5/Reporting/How-to-Set-Expiry-Time-for-Saved-Scheduled-Search-Results-to-7/m-p/688949#M12489 <P>I have a scheduled job that runs every month, storing monthly report and sending an email with the search results.<BR /><BR />This setup works well, but I've encountered a problem: the search results expire after 24 hours.</P><P>it will show me the search has probably expired or deleted.</P><P>How can i set to 7 days&nbsp; to prevent expired?</P> Wed, 29 May 2024 05:51:08 GMT https://community.splunk.com/t5/Reporting/How-to-Set-Expiry-Time-for-Saved-Scheduled-Search-Results-to-7/m-p/688949#M12489 Polarbear 2024-05-29T05:51:08Z https://community.splunk.com/t5/Reporting/How-to-Set-Expiry-Time-for-Saved-Scheduled-Search-Results-to-7/m-p/688950#M12490 <P>If you click - go into to the saved search, there is a setting called 'Job Settings',&nbsp; in there is another setting called 'lifetime', this has a setting of 10 minutes or 7 days, perhaps this will help you.&nbsp;&nbsp;</P> Wed, 29 May 2024 06:24:08 GMT https://community.splunk.com/t5/Reporting/How-to-Set-Expiry-Time-for-Saved-Scheduled-Search-Results-to-7/m-p/688950#M12490 deepakc 2024-05-29T06:24:08Z https://community.splunk.com/t5/Reporting/How-to-Set-Expiry-Time-for-Saved-Scheduled-Search-Results-to-7/m-p/688952#M12491 <DIV class=""><DIV class=""><DIV class=""><DIV class=""><P>Thank you for your reply!</P><P>Is the "lifetime" setting permanent, or does it need to be configured every time? If it's not permanent, is there any way to set it permanently for saved searches</P></DIV></DIV></DIV></DIV> Wed, 29 May 2024 06:41:19 GMT https://community.splunk.com/t5/Reporting/How-to-Set-Expiry-Time-for-Saved-Scheduled-Search-Results-to-7/m-p/688952#M12491 Polarbear 2024-05-29T06:41:19Z https://community.splunk.com/t5/Reporting/How-to-Set-Expiry-Time-for-Saved-Scheduled-Search-Results-to-7/m-p/688962#M12492 <P>It looks like you can (not someting I've done as I normally use the default, so worth try it)</P><P>From what I gather you can edit for savedsearch.conf file and under your named saved search stanza and add the dispatch.ttl setting</P><P>Example</P><P>/opt/splunk/etc/my_app/local/savedsaearch.conf</P><P>[my_saved_search]<BR />dispatch.ttl = 604800</P><P>Have a look at this link</P><P><A href="https://docs.splunk.com/Documentation/Splunk/9.2.1/Search/Extendjoblifetimes" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.2.1/Search/Extendjoblifetimes</A></P> Wed, 29 May 2024 08:32:17 GMT https://community.splunk.com/t5/Reporting/How-to-Set-Expiry-Time-for-Saved-Scheduled-Search-Results-to-7/m-p/688962#M12492 deepakc 2024-05-29T08:32:17Z