Splunk Search

Clean dispatch folder automatically in Splunk 6

shiny
Engager

Please let me know, if their is provision to clean up dispatch folder ( job already completed) automatically.

Can we set any parameter in conf file that handle it or we have to create a script for the same.

Tags (1)

inventsekar
SplunkTrust
SplunkTrust

i am not sure if you guys have already checked this, but please have a look -
http://docs.splunk.com/Documentation/Splunk/6.4.3/Search/Dispatchdirectoryandsearchartifacts
it says -
Dispatch directory maintenance
The dispatch directory reaper iterates over all artifacts every 30 seconds. It deletes artifacts that have expired based on the last time they were accessed and their configured time to live (TTL), or lifetime.

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

bleung93
Path Finder

Has there been any way of automatically cleaning up the dispatch directory yet? Besides writing an external script to remove directories?

0 Karma

Kate_Lawrence-G
Contributor

the only way to make them clear out automatically outside a cron or other script would be to set the TTL on the jobs in the savedsearches.conf to a lower value (in seconds). The jobs are treated individually in this case & not as a group.

there is a good write up here on the ttl

https://answers.splunk.com/answers/149394/is-there-a-way-to-set-the-job-ttl-to-a-different-value-for...

0 Karma

aholzel
Communicator

just make sure you don't set the value to low (below 60 sec or so) because else if you have a slight time difference between your servers you can end up with errors because the job has already been deleted before the result where presented on the screen/ the entire search on all the indexers has been completed.

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...