Saving alert artifacts for the defined time periods.

[Shisa]

Hello splunkers,

I have some scheduled alerts with a notification via email if one of the alert triggers.
I'm tying to set the different scheduled job ttl period by each one.

I'm confused the difference between dispatch.ttl and action.email.ttl in savedsearched.conf.
Which parameter should I use to set the job ttl for scheduled email alert?

Thank you

[DalJeanis]

The TTL in alert_actions.conf only applies if an alert is triggered, otherwise the TTL in savedsearches.conf applies.

So, to set the ttl for all email alerts that do trigger, you would use the ttl in the stanza for [email] in alert_actions.conf.

For email alerts that do not trigger, you would use the ttl in savedsearches.conf .

The ttl setting in limits.conf is only relevant for ad hoc searches.

For additional information and discussion, see the documentation on Search job lifespans here.

---

Here's full wording from alert_actions.conf. This wording applies individually for the settings from each kind of alert (email, rss, etc)

ttl     = <integer>[p]
* Optional argument specifying the minimum time to live (in seconds)
  of the search artifacts, if this action is triggered.
* If p follows integer, then integer is the number of scheduled periods.
* If no actions are triggered, the artifacts will have their ttl determined
  by the "dispatch.ttl" attribute in savedsearches.conf.
* Defaults to 10p
* Defaults to 86400 (24 hours)   for: email, rss
* Defaults to   600 (10 minutes) for: script
* Defaults to   120 (2 minutes)  for: summary_index, populate_lookup

Here's the full wording from savedsearches.conf

dispatch.ttl = <integer>[p]
* Indicates the time to live (in seconds) for the artifacts of the scheduled
  search, if no actions are triggered.
* If the integer is followed by the letter 'p' Splunk interprets the ttl as a
  multiple of the scheduled search's execution period (e.g. if the search is
  scheduled to run hourly and ttl is set to 2p the ttl of the artifacts will be
  set to 2 hours).
* If an action is triggered Splunk changes the ttl to that action's ttl. If
  multiple actions are triggered, Splunk applies the largest action ttl to the
  artifacts. To set the action's ttl, refer to alert_actions.conf.spec.
* For more info on search's ttl please see limits.conf.spec [search] ttl
* Defaults to 2p (that is, 2 x the period of the scheduled search).