What is the Expires parameter of an alert?


I'm not clear about the Expires parameter of an alert. What does it mean?

alt text

Tags (2)
0 Karma


The impact would be that the dispatch directory(/opt/splunk/var/run/splunk/dispatch) which stores this results set will get filled. Search head bundle will not have this result set.

0 Karma

Path Finder

It define the lifespan of triggered Alert basically how long you can access the result of triggered alert.

Please refer this document for better understanding.


Let's say we have an alert scheduled to run every five minutes, producing large result-sets and Expires of the alert is set to 24 hours. What's the impact on the system? Do the result-sets live in the search head bundle?

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...