Splunk Search

How to set search result no expiration


Dear all

I know splunk can set this with dispatch.ttl=int<\p> in savedsearches.conf or ttl in alert_actions.conf, but how can I set this with no expiration (especially triggering alerts with report), i do not want every time i must go to job list to save it.


Tags (2)
0 Karma

Splunk Employee
Splunk Employee

Set in limits.conf

default_save_ttl =
* How long the ttl for a search artifact should be extended in response to the save control action, in second. 0 = indefinitely.
* Defaults to 604800 (1 week)


also see:

ttl =
* How long search artifacts should be stored on disk once completed, in seconds.
* Defaults to 600, which is equivalent to 10 minutes.


default_save_ttl only applies to searches for which the "save control action" was triggered -- meaning the user clicked on the save button. What about when the user does not click on save?

0 Karma


Can this be applied to specific scheduled saved search?It looks like global setting. Thanks

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.