Why old search jobs that should expire are not being removed from jobs directory?

anthony_copus — Tue, 19 Aug 2014 10:23:10 GMT

Hi,

Currently, our jobs directory is more than full. To fix this, we wanted to change the expiry time of jobs so they would be deleted from the jobs (as we have no need for historic ones to be stored at all). However, setting the dispatch.ttl doesn't appear to have fixed this. We have the following setting for a saved search:

[test_page_pivot]
action.email = 1
action.email.inline = 1
action.email.sendresults = 1
action.email.subject = TEST Splunk Alert: $name$
action.email.to = xxxxxxxxxxx@gmail.com
alert.digest_mode = True
alert.expires = 30m
alert.severity = 1
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
cron_schedule = */10 * * * *
dispatch.earliest_time = -24h@m
dispatch.ttl = 1p
enableSched = 1
search = | pivot TEST_page_pivot TEST_page_object count(TEST_page_object) AS "Total" SPLITCOL platform SPLITROW app_id AS "app_id" | search app_id="*" | rename VALUE AS unknown | addtotals

As you can see, dispatch.ttl is set to 1p for this query which runs every 10minutes. Therefore it should be reaped from the jobs after 10minutes, however this is not the case .

Inside jobs, the expiry time keeps being extended, even if it initially shows the expected expiry time. What's causing this?

Re: Why old search jobs that should expire are not being removed from jobs directory?

kmugglet — Fri, 25 Sep 2015 04:25:30 GMT

Hi Anthony,
Just wondering if you ever found any solution to this?

Re: Why old search jobs that should expire are not being removed from jobs directory?

sowings — Mon, 09 May 2016 16:33:25 GMT

The answer to your conundrum lies in "alert.email = 1". Any job which triggers an alert action (email, "alert", etc) takes on the TTL of that action. Check alert_actions.conf; stanza headers align with the <foo> part of "alert.<foo>" in savedsearches.conf.

topic Re: Why old search jobs that should expire are not being removed from jobs directory? in Splunk Search

Why old search jobs that should expire are not being removed from jobs directory?

Re: Why old search jobs that should expire are not being removed from jobs directory?

Re: Why old search jobs that should expire are not being removed from jobs directory?