What does "action.logevent.ttl" value represent?

[briancronrath]

Been running into issues with alerts living on way past they are supposedly expired, filling up our dispatch directories as a result.

In looking into why this might be, I noticed a action.logevent.ttl value that is defaulted to 10p (10 times the period). I can't find any information about this particular ttl value, does anyone have any more information on what it represents?

[harsmarvania57]

Hi,

Have a look at this documentation and you'll get idea about Job Artifacts TTL https://docs.splunk.com/Documentation/Splunk/7.3.1/Search/Dispatchdirectoryandsearchartifacts#Dispat...

[briancronrath]

What is the "action.logevent" ttl specific to though?

[harsmarvania57]

It means that if you have enabled "Log Event" custom alert action in your schedule search then scheduled job will be available in $SPLUNK_HOME/var/run/splunk/dispatch for 10p times. So for example if your schedule search runs at every 1 hour then that job will be available in dispatch directory for 10 * 1h = 10 hours.