Can we automatically delete searches?

[ddrillic]

A Splunk user told us that after every search they run, they go and delete it, and by doing that, they avoid the quota problems. Not the nicest procedure but it seems to be practical. Is there a way to do it automatically for users who choose to?

[tiagofbmm]

The timetolive TTL of a job can vary with many things, such as if it is a ad-hoc search, a scheduled search (varies with the frequency it runs), or the alert actions that may come out of the scheduled report, or even if the user is actively viewing a dashboard, or even if it shares the job or saves it!

So as you can see there are many reasons for a job not to be deleted. If you really want to do such thing, you need to point at the endpoint:

curl -k -u admin:pass --request DELETE https://localhost:8089/services/search/jobs/scheduler__nobody_c3BsdW5rX2FyY2hpdmVy__RMD5473cbac83d6c...

[tiagofbmm]

@ddrillic please accept an answer if it solved/helped it and upvote it. Otherwise let us know how can we help further