Splunk Search

When will ad-hoc search artifacts/results be deleted?

peterschloenske
Explorer

Hi,

I am wondering when my search artifacts/shown results will be deleted.
Default ttl for ad-hoc searches is 10min. I would expect the results of my opened & completed search to disappear after this time. Currently they don't and the expiration time is updated every time I refresh the jobs manager.

Cheers

Tags (2)
0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Yes, you are correct default ttl for ad-hoc search is 10min but if job is actively viewed in Splunk UI then status.csv file changes mod-time continuously and due to that in Job Manager expire time increase at every time when you refresh job manager & job will not delete from dispatch directory.

ttl = <integer>
* How long, in seconds, the search artifacts should be stored on disk after
  the job completes. The ttl is computed relative to the modtime of the
  status.csv file of the job, if the file exists, or the modtime of the
  artifact directory for the search job.
* If a job is being actively viewed in the Splunk UI then the modtime of
  the status.csv file is constantly updated such that the reaper does not
  remove the job from underneath.
* Default: 600 (10 minutes)

View solution in original post

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Yes, you are correct default ttl for ad-hoc search is 10min but if job is actively viewed in Splunk UI then status.csv file changes mod-time continuously and due to that in Job Manager expire time increase at every time when you refresh job manager & job will not delete from dispatch directory.

ttl = <integer>
* How long, in seconds, the search artifacts should be stored on disk after
  the job completes. The ttl is computed relative to the modtime of the
  status.csv file of the job, if the file exists, or the modtime of the
  artifact directory for the search job.
* If a job is being actively viewed in the Splunk UI then the modtime of
  the status.csv file is constantly updated such that the reaper does not
  remove the job from underneath.
* Default: 600 (10 minutes)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...