Can Splunk Do This? Index -> backfill -> /opt/splunk/var/run/splunk/dispatch

[lpolo]

I need to back fill an index from a scheduled search but the result set of the scheduled search is quite large. Therefore, the scheduled search is set up to run hourly. I do not want to increase the amount of "srchDiskQuota" in authorized.conf.
Is there way to instruct Splunk to delete the scheduled search file in "/opt/splunk/var/run/splunk/dispatch" just after it completed the index process.

Any idea ?

Thanks,
Lp

[LukeMurphey]

If you are using the alert action, then you can change the action.summary_index.ttl to a low value. In the example below, the TTL is set to 120 seconds:

[some_saved_search]
action.summary_index = 1
action.summary_index._name = summary
action.summary_index.ttl = 120
cron_schedule = 45 * * * *
dispatch.earliest_time = -65m@m
dispatch.latest_time = -5m@m
search = `some_search`

This should cause the dispatch reaper to clean up the results off of disk fairly quickly.