Been running into issues with alerts living on way past they are supposedly expired, filling up our dispatch directories as a result.
In looking into why this might be, I noticed a action.logevent.ttl value that is defaulted to 10p (10 times the period). I can't find any information about this particular ttl value, does anyone have any more information on what it represents?
Hi,
Have a look at this documentation and you'll get idea about Job Artifacts TTL https://docs.splunk.com/Documentation/Splunk/7.3.1/Search/Dispatchdirectoryandsearchartifacts#Dispat...
What is the "action.logevent" ttl specific to though?
It means that if you have enabled "Log Event" custom alert action in your schedule search then scheduled job will be available in $SPLUNK_HOME/var/run/splunk/dispatch
for 10p times. So for example if your schedule search runs at every 1 hour then that job will be available in dispatch directory for 10 * 1h = 10 hours.