Reporting

Why are scheduled searches keeping artifacts in dispatch directory for 24 hours even though retention is set to a few minutes?

GeorgeStarkey
Path Finder

I keep coming across the issue where certain scheduled searches that user may set up will keep artifacts in the dispatch directory for 24 hours, even though the retention is set to only a few minutes.

These searches run every minute, sometimes for alerts, sometimes to populate a summary or dashboard, so it's not really search specific.

I believe this has to do with how long to keep an artifact if there is some transient error in the search, and I believe this is why these are being kept beyond the set retention time. I can not find this setting however.

the_wolverine
Champion

I've been asking this question for years and no one has come forward. After a lot of testing there are several settings -- in different config files -- which will affect how long the search artifact will be stored. I figured some of these out by documenting the behavior and checking all the default settings in Splunk.

Here are some of the settings I have played with and use:

    alert_actions.conf
    [email]
    ttl = 120        
    [rss]
    ttl = 2p
    [summary_search]
    ttl = 120

    savedsearches.conf
    [default]
    dispatch.ttl = 2p
    alert.expires = 2m
    alert.severity = 2

    limits.conf:
    [search]
    ttl = 300
    default_save_ttl = 172800
    # if user clicks to save search it is stored for 1 week
    remote_ttl = 300

viswanathsd
Path Finder

In above mentioned things,which is the precedence?We are facing similar issue and trying to resolve.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...