Hi at all,
I noted a strange thing:
in a splunk 8.2.2 with ES 6.6.2, the customer scheduled some daily reports with a time period of 24 hours and I found that the dispatch.ttl for these reports has the default value of "2p", that should mean 2 days.
But The customer also found that the search results are maintained on the Splunk server for around 30 days.
Can anyone help me to understand the reasons of this behaviour and where to find the problem?
and how to reduce this disk space occupation?
Ciao.
Giuseppe
