My splunk has a problem: some jobs have a status of done but 100 days later they expire and disappear. This causes reduced performance. I had to manually delete jobs on the web interface, but this took a lot of time, because in just a month, there are up to 12000 jobs with done status.
Is there any way I can configure jobs to expire 10 days after entering the done status ?
Thanks
Most jobs should expire quickly especially saved searches which is usually twice their reoccurrence rate. Users can set to save their jobs for various periods but typically under a week. If the system is deciding to keep your jobs present for 100 days then I would be interested to know which version of Splunk you are running. Perhaps an upgrade is in your future.