Splunk Search
Highlighted

save search results?

New Member

Once a search has been created and saved, how does one change the amount of time (number of days, for example) that the results are saved?

Tags (1)
0 Karma
Highlighted

Re: save search results?

SplunkTrust
SplunkTrust

Are you talking about the change in the earliest and latest parameter for saved search??

0 Karma
Highlighted

Re: save search results?

New Member

No, somesoni2, the search parameters are ok. I'm talking about changing how long the search results are saved.

0 Karma
Highlighted

Re: save search results?

Legend

Look at this answer: Schedule Saved Search Retention which tells you to set

dispatch.ttl = <integer>[p] in the config file savedsearches.conf

However, this will only affect subsequent runs of the saved search. If you want to change the retention of a search that has already been run, you can "save" the search results. This means that the results will never expire, so you will have to manually delete the results when you don't want them any longer.

0 Karma
Highlighted

Re: save search results?

New Member

In savedsearches.conf, I do not see dispatch.ttl. I do see dispatch.earliesttime and dispatch.latesttime, but these seem to refer to the scope of the search, not the retention of search results. Any other ideas?

0 Karma
Highlighted

Re: save search results?

Legend

If it isn't there, then Splunk is using the default. So just add the line and see what happens!

0 Karma