Splunk Search

Clean dispatch folder automatically in Splunk 6

shiny
Engager

Please let me know, if their is provision to clean up dispatch folder ( job already completed) automatically.

Can we set any parameter in conf file that handle it or we have to create a script for the same.

Tags (1)

inventsekar
Ultra Champion

i am not sure if you guys have already checked this, but please have a look -
http://docs.splunk.com/Documentation/Splunk/6.4.3/Search/Dispatchdirectoryandsearchartifacts
it says -
Dispatch directory maintenance
The dispatch directory reaper iterates over all artifacts every 30 seconds. It deletes artifacts that have expired based on the last time they were accessed and their configured time to live (TTL), or lifetime.

0 Karma

bleung93
Path Finder

Has there been any way of automatically cleaning up the dispatch directory yet? Besides writing an external script to remove directories?

0 Karma

Kate_Lawrence-G
Contributor

the only way to make them clear out automatically outside a cron or other script would be to set the TTL on the jobs in the savedsearches.conf to a lower value (in seconds). The jobs are treated individually in this case & not as a group.

there is a good write up here on the ttl

https://answers.splunk.com/answers/149394/is-there-a-way-to-set-the-job-ttl-to-a-different-value-for...

0 Karma

aholzel
Communicator

just make sure you don't set the value to low (below 60 sec or so) because else if you have a slight time difference between your servers you can end up with errors because the job has already been deleted before the result where presented on the screen/ the entire search on all the indexers has been completed.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...