I seem to have found a solution. From this page: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Savedsearchesconf:
If an action is triggered, the ttl is changed to the ttl for the action. If multiple actions are triggered, the action with the largest ttl is applied to the artifacts. To set the ttl for an action, refer to the alert_actions.conf.spec file.
As I mentioned, these reports have a 'send email' action. This lead me to go to Settings > Searches, reports and alarms > Find the report in the list > Edit > Advanced Edit, finding the ttl for the 'Send email' action (action.email.ttl) and adjusting it to what I want. Now when the report runs, the search's expiry is what it should be.
I'm surprised I didn't find someone else doing this, as it must be a common issue. It would be great if someone could confirm for me whether this is standard operating procedure for Splunk 7.2.
... View more