Splunk® Enterprise

Search Manual

Download manual as PDF

Download topic as PDF

Extending job lifetimes

When you run a new search job, the job is retained in the system for a period of time, called the job lifetime. During the lifetime, you can access the job and view the data returned by the job. If the job is not accessed within the specified lifetime, the job expires and is removed from the system.

There are two lifetime settings, 10 minutes and 7 days. The lifetime starts from the moment the job is run.

Default job lifetimes

The default lifetime for a search job depends on whether the search job is an artifact of an unscheduled or scheduled search.

For example, dashboard panels that are based on an inline search, use unscheduled searches. Panels that are based on a report, use saved searches. The saved search can be unscheduled or scheduled.

Default lifetimes for unscheduled searches

When you run an ad hoc search and the search is finalized or completes on its own, the resulting search job has a default lifetime of 10 minutes. Other knowledge objects, such as real-time alerts and panels based on inline searches that use unscheduled searches have the same default lifetime.

Default lifetimes for scheduled searches

Scheduled searches launch search jobs on a regular interval. By default, these jobs are retained for the interval of the scheduled search multiplied by two. For example, if the search runs every 6 hours, the resulting jobs expire in 12 hours.

Automatic lifetime extensions

Whenever you access an active job, such as when you view the results of a search job, the lifetime is reset. The reset happens whether the job lifespan is 10 minutes or 7 days. Here are a few examples of how this works.

  • If the lifetime is set to 10 minutes and you run the search job at 11:00 AM, the job lifetime is set to end at 11:10 AM. If you run the job again at 11:07 AM, the job lifetime is reset to end at 11:17 AM.
  • If you set the lifetime for a job to 7 days and then access the job 4 days later, the job lifetime is reset and will not expire for another 7 days from the current day and time.

Changing the lifetime for the current job

You change the lifetime setting for the current ad hoc search job in the Search app.

  1. Select the Job drop-down.
  2. Select Edit Job Settings to display the Job Settings.
  3. For Lifetime, select either 10 Minutes or 7 Days.

Changing the lifetime for active jobs

You can change the lifetimes for jobs resulting from previously run unscheduled or scheduled searches. You can only change the lifetimes for active search jobs. See Manage search jobs.

Expired jobs

After the job lifetime ends, the job expires and is deleted from the system.

It is possible that while you are looking at the list of jobs that a job will expire. When you try to extend the lifetime of the expired job, a message appears explaining that the job no longer exists. You cannot extend the lifetime of an expired job.

Changing the default lifetime values

Users with the admin role, or equivalent privileges, can change the default lifetime values.

Change the default lifetime value for unscheduled searches

In Splunk Enterprise, you can change the default value for the job lifetime for unscheduled searches.

  1. Open the local limits.conf file for the Search app. For example, $SPLUNK_HOME/etc/apps/<app_name>/local.
  2. Never change or copy the configuration files in the default directory. The files in the default directory must remain intact and in their original location. See How to edit a configuration file in the Admin Manual.
  3. In the [search] stanza, change the default_save_ttl value to a number that is appropriate for your needs. The acronym TTL is an abbreviation for "time to live."

If you are using Splunk Cloud and want to change the default job lifetime value for unscheduled searches, open a Support ticket.

Change the default lifetime value for scheduled searches

In Splunk Enterprise, you can change the default lifetime for jobs resulting from a specific scheduled search.

  1. Open the local savedsearches.conf file. For example, $SPLUNK_HOME/etc/apps/<app_name>/local.
  2. Never change or copy the configuration files in the default directory. The files in the default directory must remain intact and in their original location. See How to edit a configuration file in the Admin Manual.
  3. Locate the scheduled search, and change the dispatch.ttl setting to a different interval multiple.

If you are using Splunk Cloud and want to change the default job lifetime value for scheduled searches, open a Support ticket.

PREVIOUS
About jobs and job management
  NEXT
Share jobs and export results

This documentation applies to the following versions of Splunk® Enterprise: 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.6.0, 6.6.1, 6.6.2, 6.6.3


Comments

Is there a way to change the options available for changing the lifetime of the current job, i.e. the default options are 10 Minutes or 7 Days; I'd like to have the option of changing the lifetime to 1 Day or 8 Hours for searches that take longer than 10 Minutes, but rarely take longer than 1 Day.

Dfqobvbkmnpi
April 26, 2017

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters