Alerting

What is the Expires parameter of an alert?

danielbb
Motivator

I'm not clear about the Expires parameter of an alert. What does it mean?

alt text

Tags (2)
0 Karma

saravanan90
Contributor

The impact would be that the dispatch directory(/opt/splunk/var/run/splunk/dispatch) which stores this results set will get filled. Search head bundle will not have this result set. 

https://docs.splunk.com/Documentation/Splunk/8.1.1/DistSearch/HowconfrepoworksinSHC#How_replication_...

0 Karma

ajitshukla61116
Path Finder

It define the lifespan of triggered Alert basically how long you can access the result of triggered alert.

Please refer this documenthttps://docs.splunk.com/Documentation/Splunk/8.0.1/Alert/Updatealerts for better understanding.

0 Karma

danielbb
Motivator

Let's say we have an alert scheduled to run every five minutes, producing large result-sets and Expires of the alert is set to 24 hours. What's the impact on the system? Do the result-sets live in the search head bundle?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!