Splunk Search

How to set search result no expiration

hjwang
Contributor

Dear all

I know splunk can set this with dispatch.ttl=int<\p> in savedsearches.conf or ttl in alert_actions.conf, but how can I set this with no expiration (especially triggering alerts with report), i do not want every time i must go to job list to save it.

Thanks~

Tags (2)
0 Karma

rroberts
Splunk Employee
Splunk Employee

Set in limits.conf

default_save_ttl =
* How long the ttl for a search artifact should be extended in response to the save control action, in second. 0 = indefinitely.
* Defaults to 604800 (1 week)

0=indefinitely

also see:

ttl =
* How long search artifacts should be stored on disk once completed, in seconds.
* Defaults to 600, which is equivalent to 10 minutes.

the_wolverine
Champion

default_save_ttl only applies to searches for which the "save control action" was triggered -- meaning the user clicked on the save button. What about when the user does not click on save?

0 Karma

hjwang
Contributor

Can this be applied to specific scheduled saved search?It looks like global setting. Thanks

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...