Reporting

Why are scheduled searches keeping artifacts in dispatch directory for 24 hours even though retention is set to a few minutes?

GeorgeStarkey
Path Finder

I keep coming across the issue where certain scheduled searches that user may set up will keep artifacts in the dispatch directory for 24 hours, even though the retention is set to only a few minutes.

These searches run every minute, sometimes for alerts, sometimes to populate a summary or dashboard, so it's not really search specific.

I believe this has to do with how long to keep an artifact if there is some transient error in the search, and I believe this is why these are being kept beyond the set retention time. I can not find this setting however.

the_wolverine
Champion

I've been asking this question for years and no one has come forward. After a lot of testing there are several settings -- in different config files -- which will affect how long the search artifact will be stored. I figured some of these out by documenting the behavior and checking all the default settings in Splunk.

Here are some of the settings I have played with and use:

    alert_actions.conf
    [email]
    ttl = 120        
    [rss]
    ttl = 2p
    [summary_search]
    ttl = 120

    savedsearches.conf
    [default]
    dispatch.ttl = 2p
    alert.expires = 2m
    alert.severity = 2

    limits.conf:
    [search]
    ttl = 300
    default_save_ttl = 172800
    # if user clicks to save search it is stored for 1 week
    remote_ttl = 300

viswanathsd
Path Finder

In above mentioned things,which is the precedence?We are facing similar issue and trying to resolve.

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...