topic Re: What does "action.logevent.ttl" value represent? in Splunk Search

What does "action.logevent.ttl" value represent?

briancronrath — Mon, 19 Aug 2019 22:43:22 GMT

Been running into issues with alerts living on way past they are supposedly expired, filling up our dispatch directories as a result.

In looking into why this might be, I noticed a action.logevent.ttl value that is defaulted to 10p (10 times the period). I can't find any information about this particular ttl value, does anyone have any more information on what it represents?

Re: What does "action.logevent.ttl" value represent?

harsmarvania57 — Tue, 20 Aug 2019 13:38:06 GMT

Hi,

Have a look at this documentation and you'll get idea about Job Artifacts TTL https://docs.splunk.com/Documentation/Splunk/7.3.1/Search/Dispatchdirectoryandsearchartifacts#Dispatch_directory_maintenance

Re: What does "action.logevent.ttl" value represent?

briancronrath — Wed, 21 Aug 2019 23:56:31 GMT

What is the "action.logevent" ttl specific to though?

Re: What does "action.logevent.ttl" value represent?

harsmarvania57 — Fri, 23 Aug 2019 07:55:49 GMT

It means that if you have enabled "Log Event" custom alert action in your schedule search then scheduled job will be available in $SPLUNK_HOME/var/run/splunk/dispatch for 10p times. So for example if your schedule search runs at every 1 hour then that job will be available in dispatch directory for 10 * 1h = 10 hours.