Refine your search:

I have scheduled alerts whose artifacts expire before I can get to them. Can I specify a custom ttl per alert in version 4.1.x?

asked 23 Jun '11, 14:20

the_wolverine's gravatar image

the_wolverine ♦
6.7k4233131
accept rate: 47%


2 Answers:

This is no longer an issue in version 4.2 where one can now specify a ttl per search.

link

answered 09 Oct '11, 19:22

the_wolverine's gravatar image

the_wolverine ♦
6.7k4233131
accept rate: 47%

wolverine,

Per 4.1.7 Savedsearches.conf you should be able to specify the 'dispatch.ttl' param.

dispatch.ttl = <integer>[p]
* Time to live (in seconds) for the artifacts of the scheduled search, if no actions are triggered.
* If an action is triggered the ttl is changed to that actions's ttl, if multiple actions are triggered
* the maximum ttl is applied to the artifacts. For setting action's ttl refer to alert_actions.conf.spec
* If the integer is followed by the letter 'p' the ttl is interpreted as a multiple of the scheduled search's period.
* Defaults to 2p.
link

answered 23 Jun '11, 18:54

hazekamp's gravatar image

hazekamp
2.5k2320
accept rate: 38%

Thank you, Dave. I asked because it is not clear whether this setting can be used on a per-search basis. I'll test it and report back for future reference.

(24 Jun '11, 08:33) the_wolverine ♦

Yes. In the case of savedsearches.conf all settings can be set per stanza "saved search" name.

(24 Jun '11, 08:45) hazekamp

I've had issues with getting this to work. Despite setting "dispatch.ttl = 604800" for specific alerts, I still have search artifacts that report "expired" after a couple of days. I'll file a ticket.

(14 Jul '11, 09:59) the_wolverine ♦
Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×474
×362
×115

Asked: 23 Jun '11, 14:20

Seen: 1,393 times

Last updated: 09 Oct '11, 19:22

Copyright © 2005-2014 Splunk Inc. All rights reserved.