Reporting

Why are scheduled searches keeping artifacts in dispatch directory for 24 hours even though retention is set to a few minutes?

GeorgeStarkey
Path Finder

I keep coming across the issue where certain scheduled searches that user may set up will keep artifacts in the dispatch directory for 24 hours, even though the retention is set to only a few minutes.

These searches run every minute, sometimes for alerts, sometimes to populate a summary or dashboard, so it's not really search specific.

I believe this has to do with how long to keep an artifact if there is some transient error in the search, and I believe this is why these are being kept beyond the set retention time. I can not find this setting however.

the_wolverine
Champion

I've been asking this question for years and no one has come forward. After a lot of testing there are several settings -- in different config files -- which will affect how long the search artifact will be stored. I figured some of these out by documenting the behavior and checking all the default settings in Splunk.

Here are some of the settings I have played with and use:

    alert_actions.conf
    [email]
    ttl = 120        
    [rss]
    ttl = 2p
    [summary_search]
    ttl = 120

    savedsearches.conf
    [default]
    dispatch.ttl = 2p
    alert.expires = 2m
    alert.severity = 2

    limits.conf:
    [search]
    ttl = 300
    default_save_ttl = 172800
    # if user clicks to save search it is stored for 1 week
    remote_ttl = 300

viswanathsd
Path Finder

In above mentioned things,which is the precedence?We are facing similar issue and trying to resolve.

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...