Reporting

Why are scheduled searches keeping artifacts in dispatch directory for 24 hours even though retention is set to a few minutes?

GeorgeStarkey
Path Finder

I keep coming across the issue where certain scheduled searches that user may set up will keep artifacts in the dispatch directory for 24 hours, even though the retention is set to only a few minutes.

These searches run every minute, sometimes for alerts, sometimes to populate a summary or dashboard, so it's not really search specific.

I believe this has to do with how long to keep an artifact if there is some transient error in the search, and I believe this is why these are being kept beyond the set retention time. I can not find this setting however.

the_wolverine
Champion

I've been asking this question for years and no one has come forward. After a lot of testing there are several settings -- in different config files -- which will affect how long the search artifact will be stored. I figured some of these out by documenting the behavior and checking all the default settings in Splunk.

Here are some of the settings I have played with and use:

    alert_actions.conf
    [email]
    ttl = 120        
    [rss]
    ttl = 2p
    [summary_search]
    ttl = 120

    savedsearches.conf
    [default]
    dispatch.ttl = 2p
    alert.expires = 2m
    alert.severity = 2

    limits.conf:
    [search]
    ttl = 300
    default_save_ttl = 172800
    # if user clicks to save search it is stored for 1 week
    remote_ttl = 300

viswanathsd
Path Finder

In above mentioned things,which is the precedence?We are facing similar issue and trying to resolve.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...