By default, Splunk retains the artifacts of an ad-hoc search job for 10 minutes after it completes. This duration is known as the Time To Live (TTL). The TTL is controlled by the defaultsavettl parameter within the [search] stanza of the limits.conf configuration file. The default value for this parameter is set to 600 seconds, which is equivalent to 10 minutes. After this period, Splunk's reaper process automatically removes the search job and its associated artifacts to free up disk space.

A. 5 minutes: This is incorrect. The default TTL is 600 seconds (10 minutes), not 300 seconds.

B. 1 minute: This is incorrect. The default TTL is 10 minutes, which is significantly longer than one minute.

D. 60 minutes: This is incorrect. While a TTL can be configured to 60 minutes, the default value for an ad-hoc search is 10 minutes.

1. Splunk Enterprise Documentation

limits.conf.spec:

Location: limits.conf.spec file documentation

under the [search] stanza.

Reference: The defaultsavettl parameter is defined as: "The default time to live (ttl)

in seconds

for a search job... After the ttl is reached

the search artifacts are deleted. Default: 600".

(This directly confirms the default value is 600 seconds

or 10 minutes.)

2. Splunk Enterprise Documentation

Search Manual:

Location: Chapter: "Manage search jobs"

Section: "Extend the life of a search job".

Reference: The manual explains that search jobs have a default lifetime of 10 minutes. It states

"By default

the search results are available for 10 minutes. You can extend the job lifetime when you save or share the search results."

(This corroborates the 10-minute default from a user-facing perspective.)