Reporting

Safest way to delete old finalized jobs?

gfoligna0
Explorer

I need to clean, in a safe way, my finalized jobs before they clean up by their own to avoid quota problems. Wherever on the CLI or the GUI, I should be allowed to clean these up. If I could modify the TTL of the finalized jobs to be cleaned up in a shorter amount of time will be my relief.

I've been searching in the Documentation but I couldn't find the resolution.
We're doing a lot of searches and some user quotas are full.

Right now we're deleting files (older than 5') from the dispatch directory every 5 minutes:

*/5 * * * * find /opt/splunk/var/run/splunk/dispatch/ -type d -mmin +5 | xargs /bin/rm -rf

I'll appreciate any help on this.

Thank you all!

0 Karma
1 Solution

Masa
Splunk Employee
Splunk Employee

I know this is too late. But, just in case;

We introduced a new feature to manage dispatch jobs in 4.2.3.

Here is the answer;
http://splunk-base.splunk.com/answers/29551/too-many-search-jobs-found-in-the-dispatch-directory

View solution in original post

Masa
Splunk Employee
Splunk Employee

I know this is too late. But, just in case;

We introduced a new feature to manage dispatch jobs in 4.2.3.

Here is the answer;
http://splunk-base.splunk.com/answers/29551/too-many-search-jobs-found-in-the-dispatch-directory

gfoligna0
Explorer

Cool.

What we're doing actually is deleting files (and directories) older than 5 minutes on the Dispatch Directory every minute.
I don't know if it's the best solution, but it's working for us. (:

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...