What setting in advanced edit list of a scheduled saved search stands for cleaning search artifacts after its fulfilling?
I have a scheduled saved search that runs about 30 minutes and generates a file of lets say 1Gb, after this I cannot search anything with an error message that I've exhausted space limit for my user. And I need to clean my jobs then.
Set an expiry for the saved search as mentioned by @DalJeanis in this post - https://answers.splunk.com/answers/666162/how-to-set-expiry-time-for-saved-scheduled-search-1.html
Please mark as answer if this solves your problem.
Unfortunately it's not. Though I applied this setting artifacts still exist long time after report was fulfilled.
Maybe it's because I have saved reports and this setting is only for alerts?
I see lots of settings related to dispatch, but I need not to delete search after it has been running for 2 minutes, but to clean it in two minutes after it completes and its completion can take 30 minutes or so.
There is no per-search setting controlling how long search artifacts remain after a search. IIRC, the default is twice the interval of the search.
Ask your admin to increase the search quota for your account/role.