Thanks, @tej57 . I understand your point, but I’d like to clarify something — why specifically 36 hours? My understanding was that the expiration should have been 10 minutes, so I’m curious how it ended up showing 36 hours. From what I gather, the search artifacts are governed by the clean_dispatch process, which runs on a default 36-hour interval. That’s why we’re seeing that number. The search itself likely still had its own expiration time (e.g., 10 minutes for a user search), but the cleanup of its artifacts only happens when clean_dispatch runs. So it’s not that the search’s expiration was changed to 36 hours; rather, the artifacts remained until the clean_dispatch cycle, which is set to 36 hours. Can you confirm if this is the reason why it’s showing 36 hours instead of 10 minutes? For example, could it be that Splunk marked it as a zombie search and extended the expiration to 36 hours so that clean_dispatch could clean it up?
... View more
