How to Set Expiry Time for Saved Scheduled Search Results to 7 days

[Polarbear]

I have a scheduled job that runs every month, storing monthly report and sending an email with the search results.

This setup works well, but I've encountered a problem: the search results expire after 24 hours.

it will show me the search has probably expired or deleted.

How can i set to 7 days  to prevent expired?

[deepakc]

If you click - go into to the saved search, there is a setting called 'Job Settings',  in there is another setting called 'lifetime', this has a setting of 10 minutes or 7 days, perhaps this will help you.  

[Polarbear]

Thank you for your reply!

Is the "lifetime" setting permanent, or does it need to be configured every time? If it's not permanent, is there any way to set it permanently for saved searches

[deepakc]

It looks like you can (not someting I've done as I normally use the default, so worth try it)

From what I gather you can edit for savedsearch.conf file and under your named saved search stanza and add the dispatch.ttl setting

Example

/opt/splunk/etc/my_app/local/savedsaearch.conf

[my_saved_search]
dispatch.ttl = 604800

Have a look at this link

https://docs.splunk.com/Documentation/Splunk/9.2.1/Search/Extendjoblifetimes