Scheduled Saved Search Retention

[mcwomble]

I would like to see some clear rention times for the results from saved queries. Looking through the manual (http://www.splunk.com/base/Documentation/4.1.4/User/SchedulingSavedSearches) I have found this is possible via the "Retention" Field.

I am unsure how this is field is actually used?

Does anyone have an example of how this is used within a scheduled saved search?

[Lowell · Accepted solution]

Retention has to do with how long the search results are kept around. There are couple of places where retentions period can be important: (1) If you've setup an email alert, the email will contain a link back to the search results--you don't want the search results to be removed before the recipient has a chance to open the link to the results. Or (2) if you are using a scheduled search on a dashboard; you don't want the search results to expire before the next scheduled run or no results will be available for the user (or worse yet, each user may launch their own copy of the search which could be quite intensive depending on the search.)

Generally speaking, splunk has solid defaults and neither of these scenarios are a problem. But sometimes you may find the need to tweak these intervals.

Keep in mind that there are a number of different rules that dictate the actual retention period used for any given search. Here's a copy of docs that describe the dispatch.ttl setting in the savedsearches.conf, which is the setting used to determine retention.

---

dispatch.ttl = <integer>[p]

• Time to live (in seconds) for the artifacts of the scheduled search, if no actions are triggered.
• If an action is triggered the ttl is changed to that actions's ttl, if multiple actions are triggered
• the maximum ttl is applied to the artifacts. For setting action's ttl refer to alert_actions.conf.spec
• If the integer is followed by the letter 'p' the ttl is interpreted as a multiple of the scheduled search's period.
• Defaults to 2p.

Copied from: http://www.splunk.com/base/Documentation/4.1.4/Admin/Savedsearchesconf

[triest]

If you run a scheduled search over the last 30 days and e-mail the results, the default would be to keep the search artifacts for 60 days. How often is the data useful after 30 days? For us, usually < p makes sense and we have not encountered a time > p made sense.

We have a 2TB/day license and our search artifact directory on our jobs server has exceeded 1TB at times. For smaller installations, 2p is probably fine in that it isn't harming you, but I question how often > p is really helpful.

[gkanapathy]

The documentation is incorrect and the "Retention Time" field is not visible or available in the UI. dispatch.ttl in savedsearches.conf is generally used (and is the internal equivalent), but is overridden by the ttl setting in alert_actions.conf if the search has an action. These are again not visible in the UI, but the defaults are usually fine.