Per 4.1.7 Savedsearches.conf you should be able to specify the 'dispatch.ttl' param.
dispatch.ttl = <integer>[p] * Time to live (in seconds) for the artifacts of the scheduled search, if no actions are triggered. * If an action is triggered the ttl is changed to that actions's ttl, if multiple actions are triggered * the maximum ttl is applied to the artifacts. For setting action's ttl refer to alert_actions.conf.spec * If the integer is followed by the letter 'p' the ttl is interpreted as a multiple of the scheduled search's period. * Defaults to 2p.
Can we configure per event Alerts? 1 Answer