A Splunk user told us that after every search they run, they go and delete it, and by doing that, they avoid the quota problems. Not the nicest procedure but it seems to be practical. Is there a way to do it automatically for users who choose to?
The timetolive TTL of a job can vary with many things, such as if it is a ad-hoc search, a scheduled search (varies with the frequency it runs), or the alert actions that may come out of the scheduled report, or even if the user is actively viewing a dashboard, or even if it shares the job or saves it!
So as you can see there are many reasons for a job not to be deleted. If you really want to do such thing, you need to point at the endpoint: