Splunk Search

Clean dispatch folder automatically in Splunk 6

shiny
Engager

Please let me know, if their is provision to clean up dispatch folder ( job already completed) automatically.

Can we set any parameter in conf file that handle it or we have to create a script for the same.

Tags (1)

inventsekar
SplunkTrust
SplunkTrust

i am not sure if you guys have already checked this, but please have a look -
http://docs.splunk.com/Documentation/Splunk/6.4.3/Search/Dispatchdirectoryandsearchartifacts
it says -
Dispatch directory maintenance
The dispatch directory reaper iterates over all artifacts every 30 seconds. It deletes artifacts that have expired based on the last time they were accessed and their configured time to live (TTL), or lifetime.

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

bleung93
Path Finder

Has there been any way of automatically cleaning up the dispatch directory yet? Besides writing an external script to remove directories?

0 Karma

Kate_Lawrence-G
Contributor

the only way to make them clear out automatically outside a cron or other script would be to set the TTL on the jobs in the savedsearches.conf to a lower value (in seconds). The jobs are treated individually in this case & not as a group.

there is a good write up here on the ttl

https://answers.splunk.com/answers/149394/is-there-a-way-to-set-the-job-ttl-to-a-different-value-for...

0 Karma

aholzel
Communicator

just make sure you don't set the value to low (below 60 sec or so) because else if you have a slight time difference between your servers you can end up with errors because the job has already been deleted before the result where presented on the screen/ the entire search on all the indexers has been completed.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...