Configure triggered alert expiration

[edwinmae]

Hi,

Its probably somewhere but I can't see it (find it)

http://docs.splunk.com/Documentation/Splunk/6.6.3/Alert/Updatealerts

There is only the: Trigger Actions / Add Actions / e.g. Add to Triggered Alerts

But if default is 24h and I want to set it to e.g. 7 days, how do I do that?

--

Thanks in advance

/Edwin

[lkeli_spl]

In Splunk 7.*: Settings -> Searches, reports, and alerts -> Edit -> Advanced Edit -> alert.expires

[markbarber21]

In 7.3, there is now an "Expires" field which can be set in the simple Edit Alert interface. The "Expires" value is only used to determine the TTL when using the "Add to Triggered Alerts" Action Type.

[elliotproebstel]

I believe this setting is controlled by the value set for ttl in alert_actions.conf. Here's an excerpt:

ttl     = <integer>[p]
* Optional argument specifying the minimum time to live (in seconds)
  of the search artifacts, if this action is triggered.
* If p follows integer, then integer is the number of scheduled periods.
* If no actions are triggered, the artifacts will have their ttl determined
  by the "dispatch.ttl" attribute in savedsearches.conf.
* Defaults to 10p
* Defaults to 86400 (24 hours)   for: email, rss
* Defaults to   600 (10 minutes) for: script
* Defaults to   120 (2 minutes)  for: summary_index, populate_lookup

[JordanPeterson]

to build on this if you don't want to configure these in the .conf file they can be configured by select "Advanced Edit" when you edit the alert from the "Searches, Reports, and Alerts" page. You can then filter by ".ttl"

[edwinmae]

I remember that in the 'past' this could be defined by editing the Alert. I believe that I found the related setting through Advanced Edit (Alert):

alert.expires