topic Do the resulting files from a "dump" command have a TTL? in Splunk Search

Do the resulting files from a "dump" command have a TTL?

actionabledata — Mon, 06 Jun 2022 19:33:39 GMT

Do the resulting files from a "dump" command have a TTL? I think they must since the files I created on Friday no longer exist.

Here is the search I am using to create the files.

index = “myIndexName” sourcetype=”mySourcetype” myFilterField IN(123ABC, 456DEF, 789GHI) | dump basefilename= ABCCorp_06-06-22_0800_01330_ rollsize=1000 compress=5 format=raw | table *

Thank you.

Re: Do the resulting files from a "dump" command have a TTL?

jamie00171 — Wed, 08 Jun 2022 18:06:45 GMT

Hi @actionabledata

Based on where the documentation: https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchReference/Dump#Usage

states they are stored: "$SPLUNK_HOME/var/run/splunk/dispatch/<sid>/dump/

I'd assume they have the same TTL as the rest of the search artifacts which is believe is 15 minutes by default for an ad-hoc search or 2 times the scheduled period for a savedsearch.

Thanks,

Jamie

Re: Do the resulting files from a "dump" command have a TTL?

actionabledata — Fri, 10 Jun 2022 12:47:42 GMT

Thanks Jamie.

Yeah, I saw that and made the same assumptions but couldn't find a definitive answer. Through a few not-so-scientific experiments, I found the TTL to be longer than 15 min but less than 3 hrs ... but the files DO go away.

Thanks, Greg (ActionableData)