Reporting

how to set expiry time for saved scheduled search results

ramki1459
Explorer

Hello all.. i have a scheduled job which will run for every 1 hr and store results in summary index and send an email with search results. so far so good, but problem i am facing is, search results are expiring after 24 hrs which is causing data limit on my account. after some investigation i found that, if there is an email alert, splunk by default will store results for 24 hrs. so, i removed email alert and search results are expiring after 1 hr (which really solved my problem).

using above approach, since there is no email after 1 hr job runs, i don't know whether hrly jobs are running fine or not. so, i want to get an email alert (no link to search results) with expiry as 1 hr. could someone help me on how to solve this problem.

Note: i dont have permissions to change values in alert_actions.conf, savedsearches.conf .. etc

thanks in advance

Tags (1)
0 Karma

woodcock
Esteemed Legend

Read the options for dispatch.ttl in this document:

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Savedsearchesconf
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

https://docs.splunk.com/Documentation/SplunkCloud/7.0.3/Alert/Updatealerts

See the section on "Configure triggered alert expiration"

0 Karma

ramki1459
Explorer

i don't see the option which was mentioned in splunk documentation because of this "These steps apply only to alerts with the "Add to Triggered Alerts" action enabled." looks like i don't have permission to set this setting.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...