As the default ES DMA schedule is every 5min, and the _ACCELERATE_DM_Splunk_SA_CIM_*_ACCELERATE_ jobs TTL is 24h, our dispatch directory is filling up
24h TTL with 5min runs means 288 jobs per DM,
which is obviously rewarding us with the famous "The number of search artifacts in the dispatch directory is higher than recommended "
Is it expected for these jobs TTL to be 24h? I was somehow expecting it to be 2p
Ran btool limits list --debug but there isn't any local conf overwriting the defaults
NOTE:
results obtained from:
| rest /services/search/jobs/
| search label=_ACCELERATE_DM_Splunk_SA_CIM_*ACCELERATE_
↧