Splunk Search

Saved searches lifetime: difference between dispatch.ttl and alert.expires in savedsearches.conf

BernardEAI
Communicator

I'm trying to accurately control the lifetime of the search artifacts of a saved search. I have set the "Expiry" time to 30 mins in the saved search, but if I check the artifacts in the  "Jobs" view, the expiry of the search is 2 hours after start.

Looking at the savesdearches.conf I see the item "alert.expires = 30m" in the saved search stanza. I have also seen the item "dispatch.ttl" in the Spunk documentation for savedsearches.conf, where it states:

dispatch.ttl = <integer>[p]
* Indicates the time to live (ttl), in seconds, for the artifacts of the
  scheduled search, if no actions are triggered.

 According to that the life of the artifacts is controlled by this parameter. What does alert.expires control? Is there a way to set dispatch.ttl via the UI?

Labels (1)
Tags (1)
0 Karma
1 Solution

BernardEAI
Communicator

I found the answer to the question: the "dispatch.ttl" can be configured in the "Advanced Edit" of the saved search.

View solution in original post

0 Karma

BernardEAI
Communicator

I found the answer to the question: the "dispatch.ttl" can be configured in the "Advanced Edit" of the saved search.

0 Karma

gjanders
SplunkTrust
SplunkTrust

Because non-admins couldn't always see the advanced edit I created an app / code here https://github.com/gjanders/SplunkOther so that they could change the TTL of there own alerts without hitting the REST API...

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...