Setting for cleaning scheduled saved search artifacts after its fulfilling

[iKate]

Hi!
What setting in advanced edit list of a scheduled saved search stands for cleaning search artifacts after its fulfilling?

I have a scheduled saved search that runs about 30 minutes and generates a file of lets say 1Gb, after this I cannot search anything with an error message that I've exhausted space limit for my user. And I need to clean my jobs then.

Thanks!

[woodcock]

In the advanced setting area of your scheduled saved search, you can configure the TTL for the artifacts. For big ones like this, set it to very low (like 10 seconds).

[SamHTexas]

Please show me where (which Splunk server) this advanced setting area is located & how to change the TTL. Thank u

[arjunpkishore5]

Set an expiry for the saved search as mentioned by @DalJeanis in this post - https://answers.splunk.com/answers/666162/how-to-set-expiry-time-for-saved-scheduled-search-1.html

Please mark as answer if this solves your problem.

[iKate]

Thanks, it was exactly what I needed: alert.expires

[iKate]

Unfortunately it's not. Though I applied this setting artifacts still exist long time after report was fulfilled.
Maybe it's because I have saved reports and this setting is only for alerts?
I see lots of settings related to dispatch, but I need not to delete search after it has been running for 2 minutes, but to clean it in two minutes after it completes and its completion can take 30 minutes or so.

[arjunpkishore5]

Trying to understand the use-case. Do you want to kill the search if it's running for longer than 2 mins ?

[richgalloway]

There is no per-search setting controlling how long search artifacts remain after a search. IIRC, the default is twice the interval of the search.
Ask your admin to increase the search quota for your account/role.