Here's full wording from alert_actions.conf. This wording applies individually for the settings from each kind of alert (email, rss, etc)
ttl = <integer>[p]
* Optional argument specifying the minimum time to live (in seconds)
of the search artifacts, if this action is triggered.
* If p follows integer, then integer is the number of scheduled periods.
* If no actions are triggered, the artifacts will have their ttl determined
by the "dispatch.ttl" attribute in savedsearches.conf.
* Defaults to 10p
* Defaults to 86400 (24 hours) for: email, rss
* Defaults to 600 (10 minutes) for: script
* Defaults to 120 (2 minutes) for: summary_index, populate_lookup
Here's the full wording from savedsearches.conf
dispatch.ttl = <integer>[p]
* Indicates the time to live (in seconds) for the artifacts of the scheduled
search, if no actions are triggered.
* If the integer is followed by the letter 'p' Splunk interprets the ttl as a
multiple of the scheduled search's execution period (e.g. if the search is
scheduled to run hourly and ttl is set to 2p the ttl of the artifacts will be
set to 2 hours).
* If an action is triggered Splunk changes the ttl to that action's ttl. If
multiple actions are triggered, Splunk applies the largest action ttl to the
artifacts. To set the action's ttl, refer to alert_actions.conf.spec.
* For more info on search's ttl please see limits.conf.spec [search] ttl
* Defaults to 2p (that is, 2 x the period of the scheduled search).