Is there a setting that stops the "AutomIatic lifetime extensions" (https://docs.splunk.com/Documentation/Splunk/9.0.3/Search/Extendjoblifetimes) of scheduled searches?
We have some dashboard with scheduled searches , refreshed every x time, that are mainly used during business hours. so we scheduled them for only the business hours. Sometime someones need to look at the dash in the night.
To be sure, they see a recent result we changed the dispatch.ttl too 600 (normally its run every 5 minutes) . So if the last schedule would be @6 pm, the results should be gone @6:10 pm . If someone opens the dash @ 8pm, there aren't any results, and the search should run again.
Now the real problem, some people aren't closing the dashboard. So the last run (that was @ 6 pm) keeps getting extended! So if someone else needs to take a look at the dashboard it's displaying the last run!
So is there a setting to force the results to be deleted after x period?
