https://community.splunk.com/t5/Alerting/Scheduled-search-period/m-p/42746#M532 <P>Can someone clarify what is meant by a "period"? Context is this:</P> <P>"* If the integer is followed by the letter 'p' the ttl is interpreted as a multiple of the scheduled search's period."</P> <P>I would interpret this as, if my scheduled search runs once per hour and I specify a period of 10p, that would mean my search artifact would survive for 10 hours. </P> Thu, 14 Jul 2011 17:07:23 GMT the_wolverine 2011-07-14T17:07:23Z https://community.splunk.com/t5/Alerting/Scheduled-search-period/m-p/42746#M532 <P>Can someone clarify what is meant by a "period"? Context is this:</P> <P>"* If the integer is followed by the letter 'p' the ttl is interpreted as a multiple of the scheduled search's period."</P> <P>I would interpret this as, if my scheduled search runs once per hour and I specify a period of 10p, that would mean my search artifact would survive for 10 hours. </P> Thu, 14 Jul 2011 17:07:23 GMT https://community.splunk.com/t5/Alerting/Scheduled-search-period/m-p/42746#M532 the_wolverine 2011-07-14T17:07:23Z https://community.splunk.com/t5/Alerting/Scheduled-search-period/m-p/42747#M533 <P>Yes this is the meaning.</P> <P>if a search runs every hour ( cron 0 * * * * ) with a ttl of 10p ( 10 periods), will store the results for 10 hours.<BR /> FYI the default ttl is 2p.</P> Mon, 15 Oct 2012 05:12:13 GMT https://community.splunk.com/t5/Alerting/Scheduled-search-period/m-p/42747#M533 yannK 2012-10-15T05:12:13Z