Knowledge Management

How can I change default lifetime of job?

simon_b
Path Finder

I have the problem that my scheduled searches all have a lifetime of 10 days.

This is the case for searches that run once every day but also searches that run every 4 hours. Changing the "Expires" value doesn't affect that 10 days lifetime.

How can I change the default lifetime of my scheduled searches?

Labels (1)
0 Karma
1 Solution

inventsekar
SplunkTrust
SplunkTrust

Hi .. please check:https://www.splunk.com/en_us/blog/conf-splunklive/how-long-does-my-search-live-default-search-ttl.ht...

You can change a ttl either by setting an individual value for a search when you save it, set a dispatch.ttl value (either global or for an individual search) in savedsearches.conf or the [search] or [subsearch] stanzas in limits.conf (ttl or remote_ttl in [search] or ttl in [subsearch].) Have a look at the documentation in savedsearches.conf.spec and limits.conf.spec for more on how to specify these values. Most are given in seconds, except for dispatch.ttl which can also specify the number of schedule periods (like “2p”.)

@simon_b

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

View solution in original post

inventsekar
SplunkTrust
SplunkTrust

Hi .. please check:https://www.splunk.com/en_us/blog/conf-splunklive/how-long-does-my-search-live-default-search-ttl.ht...

You can change a ttl either by setting an individual value for a search when you save it, set a dispatch.ttl value (either global or for an individual search) in savedsearches.conf or the [search] or [subsearch] stanzas in limits.conf (ttl or remote_ttl in [search] or ttl in [subsearch].) Have a look at the documentation in savedsearches.conf.spec and limits.conf.spec for more on how to specify these values. Most are given in seconds, except for dispatch.ttl which can also specify the number of schedule periods (like “2p”.)

@simon_b

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...