9/12/2023 0 Comments Splunk subsearch timeoutReview the information about the dispatch.ttl setting in the Dispatch search options section of the file in the Admin Manual.Only system administrators with the sc_admin role should change default lifetime values.Splunk Cloud Platform You can use Splunk Web to make this change. You can change the default lifetime for jobs resulting from a specific scheduled search. The acronym TTL is an abbreviation for "time to live." The default_save_ttl setting measures search job time to live in seconds, and defaults to 604800 seconds, or one week.Ĭhange the default lifetime value for scheduled searches In the stanza, change the default_save_ttl value to a number that is appropriate for your needs.For example, $SPLUNK_HOME/etc/apps//local. Open the local nf file for the Search app.The files in the default directory must remain intact and in their original location. Never change or copy the configuration files in the default directory. Review the steps in How to edit a configuration file in the Admin Manual.Only users with file system access, such as system administrators, can change the default lifetime values.Otherwise, contact Splunk Customer Support. If you have a support contract, file a new case using the Splunk Support Portal at Support and Services. Splunk Cloud Platform To change the default value for the job lifetime for unscheduled searches, request help from Splunk Support. ![]() You can change the default value for the job lifetime for unscheduled searches. You can change the default value for the job lifetime for unscheduled and scheduled searches.Ĭhange the default lifetime value for unscheduled searches You cannot extend the lifetime of an expired job. When you try to extend the lifetime of the expired job, a message appears explaining that the job no longer exists. It is possible that while you are looking at the list of jobs that a job will expire. See Manage search jobs.Īfter the job lifetime ends, the job expires and is deleted from the system. You can only change the lifetimes for active search jobs. ![]() You can't change the lifetimes for jobs resulting from previously run unscheduled or scheduled searches. For Lifetime, select either 10 Minutes or 7 Days.Select Edit Job Settings to display the Job Settings.You change the lifetime setting for the current ad hoc search job in the Search app. If you set the lifetime for a job to 7 days and then access the job 4 days later, the job lifetime is reset and will not expire for another 7 days from the current day and time.Ĭhanging the lifetime for the current job.If you run the job again at 11:07 AM, the job lifetime is reset to end at 11:17 AM. If the lifetime is set to 10 minutes and you run the search job at 11:00 AM, the job lifetime is set to end at 11:10 AM.Here are a few examples of how this works. The reset happens whether the job lifespan is 10 minutes or 7 days. Whenever you access an active job, such as when you view the results of a search job, the lifetime is reset. ![]() For example, if the search runs every 6 hours, the resulting jobs expire in 12 hours. By default, these jobs are retained for the interval of the scheduled search multiplied by two. Scheduled searches launch search jobs on a regular interval. Other knowledge objects, such as real-time alerts and panels based on inline searches that use unscheduled searches have the same default lifetime. When you run an ad hoc search and the search is finalized or completes on its own, the resulting search job has a default lifetime of 10 minutes. The saved search can be unscheduled or scheduled.ĭefault lifetimes for unscheduled searches Panels that are based on a report, use saved searches. The default lifetime for a search job depends on whether the search job is an artifact of an unscheduled or scheduled search.įor example, dashboard panels that are based on an inline search, use unscheduled searches. The lifetime starts from the moment the job is run. There are two lifetime settings, 10 minutes and 7 days. If the job is not accessed within the specified lifetime, the job expires and is removed from the system. During the lifetime, you can access the job and view the data returned by the job. When you run a new search job, the job is retained in the system for a period of time, called the job lifetime.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |