Splunk Search

How to set search result no expiration

hjwang
Contributor

Dear all

I know splunk can set this with dispatch.ttl=int<\p> in savedsearches.conf or ttl in alert_actions.conf, but how can I set this with no expiration (especially triggering alerts with report), i do not want every time i must go to job list to save it.

Thanks~

Tags (2)
0 Karma

rroberts
Splunk Employee
Splunk Employee

Set in limits.conf

default_save_ttl =
* How long the ttl for a search artifact should be extended in response to the save control action, in second. 0 = indefinitely.
* Defaults to 604800 (1 week)

0=indefinitely

also see:

ttl =
* How long search artifacts should be stored on disk once completed, in seconds.
* Defaults to 600, which is equivalent to 10 minutes.

the_wolverine
Champion

default_save_ttl only applies to searches for which the "save control action" was triggered -- meaning the user clicked on the save button. What about when the user does not click on save?

0 Karma

hjwang
Contributor

Can this be applied to specific scheduled saved search?It looks like global setting. Thanks

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.