topic How to set search result no expiration in Splunk Search

How to set search result no expiration

hjwang — Fri, 13 Jul 2012 10:16:40 GMT

Dear all

I know splunk can set this with dispatch.ttl=int<\p> in savedsearches.conf or ttl in alert_actions.conf, but how can I set this with no expiration (especially triggering alerts with report), i do not want every time i must go to job list to save it.

Thanks~

Re: How to set search result no expiration

rroberts — Mon, 28 Sep 2020 12:06:15 GMT

Set in limits.conf

default_save_ttl =
* How long the ttl for a search artifact should be extended in response to the save control action, in second. 0 = indefinitely.
* Defaults to 604800 (1 week)

0=indefinitely

also see:

ttl =
* How long search artifacts should be stored on disk once completed, in seconds.
* Defaults to 600, which is equivalent to 10 minutes.

Re: How to set search result no expiration

hjwang — Tue, 17 Jul 2012 03:29:26 GMT

Can this be applied to specific scheduled saved search?It looks like global setting. Thanks

Re: How to set search result no expiration

the_wolverine — Mon, 28 Sep 2020 16:35:04 GMT

default_save_ttl only applies to searches for which the "save control action" was triggered -- meaning the user clicked on the save button. What about when the user does not click on save?