Is there a way to set the job ttl to a different value for a saved search?
You can also use "| noop set_ttl = <NumberOfSecondsHere>"
bohrasaurabh gave you the answer, edit your search (in savedsearches.conf) As a line like:
dispatch.ttl = 3600
Note that the time is in seconds
Note that you can also specify the value as [0-9]+p
, e.g. dispatch.ttl = 7p
- this means "save 7 versions of the saved search".
You can then use old searches with, for example | loadjob savedsearch="x:y:z" artifact_offset=3
dispatch.ttl for savedsearch is different from jobs ttl. my understanding is jobs ttl defines how long the job will be in jobs activity.
Yes, the TTL setting for the alert overrides the setting in savedsearches.conf, but you should set the TTL in both places. The TTL in alert_actions.conf only applies if an alert is triggered, otherwise the TTL in savedsearches.conf applies.
In both places, you can use the p notation or just the number of seconds to save.
There are also settings for TTL in limits.conf, but those only apply to ad hoc searches.
I guess you can update savedsearches.conf file for that saved search and set the dispatch.ttl to your configured value. Is that what you're looking for?