How to set search result no expiration

[hjwang]

Dear all

I know splunk can set this with dispatch.ttl=int<\p> in savedsearches.conf or ttl in alert_actions.conf, but how can I set this with no expiration (especially triggering alerts with report), i do not want every time i must go to job list to save it.

Thanks~

[rroberts]

Set in limits.conf

default_save_ttl =
* How long the ttl for a search artifact should be extended in response to the save control action, in second. 0 = indefinitely.
* Defaults to 604800 (1 week)

0=indefinitely

also see:

ttl =
* How long search artifacts should be stored on disk once completed, in seconds.
* Defaults to 600, which is equivalent to 10 minutes.

[the_wolverine]

default_save_ttl only applies to searches for which the "save control action" was triggered -- meaning the user clicked on the save button. What about when the user does not click on save?

[hjwang]

Can this be applied to specific scheduled saved search?It looks like global setting. Thanks