How do you save reports for long term access?

[kbb]

Once reports or saved results are saved, how long are they accessible from the "jobs" page? In the users manual in the "saving reports" section it states "Selecting Get link... automatically saves your report job, which you can access thereafter through the Jobs page". How long is "thereafter"? If you save the results of a report can those be archived elsewhere?

[lguinn2]

Once a search job is saved, it is saved forever. It is possible, though, for the Splunk admin to clean out old search jobs. And anyone who has "write" permissions to the search job can delete it as well.

Splunk doesn't actually save the report - it saves a logical list of the events in the search result. This is part of the "artifacts" of a search job. The artifacts are stored in this directory, and each search job has its own subdirectoy:

$SPLUNK_HOME/var/run/splunk/dispatch

I suppose that you could archive this directory if you wanted to archive your search results. However, it might be easier to export your search results and save that instead...

[Jordan_Brough]

Is this still true? I just now did a "Save & Share Results" on a search job and when I inspect the job in the job inspector I see a TTL of 1 week. And in the past I have seen search jobs disappear after some time (I assume it was one week).