Reporting
Highlighted

Is there a way to set the job TTL to a different value for a saved search?

Communicator

Is there a way to set the job ttl to a different value for a saved search?

Highlighted

Re: Is there a way to set the job TTL to a different value for a saved search?

SplunkTrust
SplunkTrust

I guess you can update savedsearches.conf file for that saved search and set the dispatch.ttl to your configured value. Is that what you're looking for?

0 Karma
Highlighted

Re: Is there a way to set the job TTL to a different value for a saved search?

Communicator

dispatch.ttl for savedsearch is different from jobs ttl. my understanding is jobs ttl defines how long the job will be in jobs activity.

0 Karma
Highlighted

Re: Is there a way to set the job TTL to a different value for a saved search?

Splunk Employee
Splunk Employee

Yes, the TTL setting for the alert overrides the setting in savedsearches.conf, but you should set the TTL in both places. The TTL in alert_actions.conf only applies if an alert is triggered, otherwise the TTL in savedsearches.conf applies.

In both places, you can use the p notation or just the number of seconds to save.

There are also settings for TTL in limits.conf, but those only apply to ad hoc searches.

0 Karma
Highlighted

Re: Is there a way to set the job TTL to a different value for a saved search?

SplunkTrust
SplunkTrust
0 Karma
Highlighted

Re: Is there a way to set the job TTL to a different value for a saved search?

SplunkTrust
SplunkTrust

bohrasaurabh gave you the answer, edit your search (in savedsearches.conf) As a line like:

dispatch.ttl = 3600

Note that the time is in seconds

Highlighted

Re: Is there a way to set the job TTL to a different value for a saved search?

Communicator

Note that you can also specify the value as [0-9]+p, e.g. dispatch.ttl = 7p - this means "save 7 versions of the saved search".

You can then use old searches with, for example | loadjob savedsearch="x:y:z" artifact_offset=3

0 Karma