Splunk Search

save search results?

jlawsonmers
New Member

Once a search has been created and saved, how does one change the amount of time (number of days, for example) that the results are saved?

Tags (1)
0 Karma

lguinn2
Legend

Look at this answer: Schedule Saved Search Retention which tells you to set

dispatch.ttl = <integer>[p] in the config file savedsearches.conf

However, this will only affect subsequent runs of the saved search. If you want to change the retention of a search that has already been run, you can "save" the search results. This means that the results will never expire, so you will have to manually delete the results when you don't want them any longer.

0 Karma

lguinn2
Legend

If it isn't there, then Splunk is using the default. So just add the line and see what happens!

0 Karma

jlawsonmers
New Member

In savedsearches.conf, I do not see dispatch.ttl. I do see dispatch.earliest_time and dispatch.latest_time, but these seem to refer to the scope of the search, not the retention of search results. Any other ideas?

0 Karma

jlawsonmers
New Member

No, somesoni2, the search parameters are ok. I'm talking about changing how long the search results are saved.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Are you talking about the change in the earliest and latest parameter for saved search??

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...