Links in alerts not working

[bhavneeshvohra]

We have one Real Time and one scheduled alert ,in both these alerts we have alert actions as mail .
In the mail we send a link of " View results in Splunk".
But we have found that these links get expired after 24 hours .
How should we deal with this issue.?
Kindly help!!

[renjith_nair]

@bhavneeshvohra,

The expiring time of the artifacts are decided by dispatch ttl in savedsearch.conf and based on your alert actions, ttl value in alert_actions.conf will take effect.

See alert_actions.conf

ttl = <integer>[p]
* The minimum time to live, in seconds, of the search artifacts,
  if this action is triggered.
* If 'p' follows '<integer>', then '<integer>' is the number of scheduled periods.
* If no actions are triggered, the ttl for the artifacts are determined
  by the 'dispatch.ttl' setting in the savedsearches.conf file.
* Default: 10p
* Default (for email, rss)                    : 86400 (24 hours)
* Default (for script)                        :   600 (10 minutes)
* Default (for summary_index, populate_lookup):   120 (2 minutes)