Hi!
What setting in advanced edit list of a scheduled saved search stands for cleaning search artifacts after its fulfilling?
I have a scheduled saved search that runs about 30 minutes and generates a file of lets say 1Gb, after this I cannot search anything with an error message that I've exhausted space limit for my user. And I need to clean my jobs then.
Thanks!
In the advanced
setting area of your scheduled saved search
, you can configure the TTL
for the artifacts. For big ones like this, set it to very low (like 10 seconds).
Please show me where (which Splunk server) this advanced setting area is located & how to change the TTL. Thank u
Set an expiry for the saved search as mentioned by @DalJeanis in this post - https://answers.splunk.com/answers/666162/how-to-set-expiry-time-for-saved-scheduled-search-1.html
Please mark as answer if this solves your problem.
Thanks, it was exactly what I needed: alert.expires
Unfortunately it's not. Though I applied this setting artifacts still exist long time after report was fulfilled.
Maybe it's because I have saved reports and this setting is only for alerts?
I see lots of settings related to dispatch, but I need not to delete search after it has been running for 2 minutes, but to clean it in two minutes after it completes and its completion can take 30 minutes or so.
Trying to understand the use-case. Do you want to kill the search if it's running for longer than 2 mins ?
There is no per-search setting controlling how long search artifacts remain after a search. IIRC, the default is twice the interval of the search.
Ask your admin to increase the search quota for your account/role.