Clean dispatch folder automatically in Splunk 6

[shiny]

Please let me know, if their is provision to clean up dispatch folder ( job already completed) automatically.

Can we set any parameter in conf file that handle it or we have to create a script for the same.

[inventsekar]

i am not sure if you guys have already checked this, but please have a look -
http://docs.splunk.com/Documentation/Splunk/6.4.3/Search/Dispatchdirectoryandsearchartifacts
it says -
Dispatch directory maintenance
The dispatch directory reaper iterates over all artifacts every 30 seconds. It deletes artifacts that have expired based on the last time they were accessed and their configured time to live (TTL), or lifetime.

[bleung93]

Has there been any way of automatically cleaning up the dispatch directory yet? Besides writing an external script to remove directories?

[Kate_Lawrence-G]

the only way to make them clear out automatically outside a cron or other script would be to set the TTL on the jobs in the savedsearches.conf to a lower value (in seconds). The jobs are treated individually in this case & not as a group.

there is a good write up here on the ttl

https://answers.splunk.com/answers/149394/is-there-a-way-to-set-the-job-ttl-to-a-different-value-for...

[aholzel]

just make sure you don't set the value to low (below 60 sec or so) because else if you have a slight time difference between your servers you can end up with errors because the job has already been deleted before the result where presented on the screen/ the entire search on all the indexers has been completed.