Reporting

Why are scheduled searches keeping artifacts in dispatch directory for 24 hours even though retention is set to a few minutes?

GeorgeStarkey
Path Finder

I keep coming across the issue where certain scheduled searches that user may set up will keep artifacts in the dispatch directory for 24 hours, even though the retention is set to only a few minutes.

These searches run every minute, sometimes for alerts, sometimes to populate a summary or dashboard, so it's not really search specific.

I believe this has to do with how long to keep an artifact if there is some transient error in the search, and I believe this is why these are being kept beyond the set retention time. I can not find this setting however.

the_wolverine
Champion

I've been asking this question for years and no one has come forward. After a lot of testing there are several settings -- in different config files -- which will affect how long the search artifact will be stored. I figured some of these out by documenting the behavior and checking all the default settings in Splunk.

Here are some of the settings I have played with and use:

    alert_actions.conf
    [email]
    ttl = 120        
    [rss]
    ttl = 2p
    [summary_search]
    ttl = 120

    savedsearches.conf
    [default]
    dispatch.ttl = 2p
    alert.expires = 2m
    alert.severity = 2

    limits.conf:
    [search]
    ttl = 300
    default_save_ttl = 172800
    # if user clicks to save search it is stored for 1 week
    remote_ttl = 300

viswanathsd
Path Finder

In above mentioned things,which is the precedence?We are facing similar issue and trying to resolve.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...