Reporting

Is there a way to set the job TTL to a different value for a saved search?

bohrasaurabh
Communicator

Is there a way to set the job ttl to a different value for a saved search?

guilmxm
SplunkTrust
SplunkTrust

bohrasaurabh gave you the answer, edit your search (in savedsearches.conf) As a line like:

dispatch.ttl = 3600

Note that the time is in seconds

bhawkins1
Communicator

Note that you can also specify the value as [0-9]+p, e.g. dispatch.ttl = 7p - this means "save 7 versions of the saved search".

You can then use old searches with, for example | loadjob savedsearch="x:y:z" artifact_offset=3

0 Karma

somesoni2
Revered Legend
0 Karma

bohrasaurabh
Communicator

dispatch.ttl for savedsearch is different from jobs ttl. my understanding is jobs ttl defines how long the job will be in jobs activity.

0 Karma

risgupta_splunk
Splunk Employee
Splunk Employee

Yes, the TTL setting for the alert overrides the setting in savedsearches.conf, but you should set the TTL in both places. The TTL in alert_actions.conf only applies if an alert is triggered, otherwise the TTL in savedsearches.conf applies.

In both places, you can use the p notation or just the number of seconds to save.

There are also settings for TTL in limits.conf, but those only apply to ad hoc searches.

0 Karma

somesoni2
Revered Legend

I guess you can update savedsearches.conf file for that saved search and set the dispatch.ttl to your configured value. Is that what you're looking for?

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!