Can we set the ttl for knowledge bundles on indexers?

[ben_leung]

We have a version 6.3.4 search head cluster and indexers, in a distributed search environment. Noticing that the searchpeers directory has the bundle along with the deltas. Can we set a time to live for these directories? Similar to setting a ttl for dispatch artifacts from scheduled runs.

Not sure if there is a configuration in distsearch or limits that would be able to do this.

[esix_splunk · Accepted solution]

You can adjust the local and remote TTL for the indexers in limits.conf.

For more information on the effects of this, please read this article :

http://blogs.splunk.com/2012/09/12/how-long-does-my-search-live-default-search-ttl/

You can change a ttl either by setting an individual value for a search when you save it, set a dispatch.ttl value (either global or for an individual search) in savedsearches.conf or the [search] or [subsearch] stanzas in limits.conf (ttl or remote_ttl in [search] or ttl in [subsearch].) Have a look at the documentation in savedsearches.conf.spec and limits.conf.spec for more on how to specify these values. Most are given in seconds, except for dispatch.ttl which can also specify the number of schedule periods (like “2p”.)

And here is a link to the spec file for limits.conf, for your reading pleasure.