Conditions:
1) Scheduled search that runs every minute and writes to summary index.
2) Additionally, configured to alert "always" and email to someone@email.address.
3) Expiration set to custom time, 1 second.
4) savedsearches.conf config for this search clearly shows 1s expiration value:
alert.expires = 1s
Expectation -- only 1 (or a few) directories related to this search in dispatch. Its ok if the cleanup job can't run often enough to keep it exactly at 1 second, even a few minutes would be fine.
Observation -- over 1000 directories generated by this scheduled search.
Suspicion - This scheduled search is affected because it is considered an alert and different ttl applies to the generated "alert" artifacts.
Of more specific suspicion, in etc/system/default/alert_actions.conf:
ttl = 86400
(86400 seconds = 24 hours)
Or, there's a bug.
A job which triggers an alert action takes on the TTL of that action.