Splunk Search

Clean dispatch folder automatically in Splunk 6


Please let me know, if their is provision to clean up dispatch folder ( job already completed) automatically.

Can we set any parameter in conf file that handle it or we have to create a script for the same.

Tags (1)


i am not sure if you guys have already checked this, but please have a look -
it says -
Dispatch directory maintenance
The dispatch directory reaper iterates over all artifacts every 30 seconds. It deletes artifacts that have expired based on the last time they were accessed and their configured time to live (TTL), or lifetime.

0 Karma

Path Finder

Has there been any way of automatically cleaning up the dispatch directory yet? Besides writing an external script to remove directories?

0 Karma


the only way to make them clear out automatically outside a cron or other script would be to set the TTL on the jobs in the savedsearches.conf to a lower value (in seconds). The jobs are treated individually in this case & not as a group.

there is a good write up here on the ttl


0 Karma


just make sure you don't set the value to low (below 60 sec or so) because else if you have a slight time difference between your servers you can end up with errors because the job has already been deleted before the result where presented on the screen/ the entire search on all the indexers has been completed.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...