Do the resulting files from a "dump" command have a TTL?

[actionabledata]

Do the resulting files from a "dump" command have a TTL? I think they must since the files I created on Friday no longer exist.

Here is the search I am using to create the files.

index = “myIndexName” sourcetype=”mySourcetype” myFilterField IN(123ABC, 456DEF, 789GHI)
| dump basefilename= ABCCorp_06-06-22_0800_01330_ rollsize=1000 compress=5 format=raw
| table *

Thank you.

[jamie00171]

Hi @actionabledata 

Based on where the documentation: https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchReference/Dump#Usage

states they are stored: "$SPLUNK_HOME/var/run/splunk/dispatch/<sid>/dump/

I'd assume they have the same TTL as the rest of the search artifacts which is believe is 15 minutes by default for an ad-hoc search or 2 times the scheduled period for a savedsearch. 

Thanks, 

Jamie

[actionabledata · Accepted solution]

Thanks Jamie.

Yeah, I saw that and made the same assumptions but couldn't find a definitive answer. Through a few not-so-scientific experiments, I found the TTL to be longer than 15 min but less than 3 hrs ... but the files DO go away.

Thanks, Greg (ActionableData)