@damien_chillet, @elliotproebstel
So in the default alert_actions, email has a default of 86400, but there IS an alert_actions in local, but without a TTL. Then, in the default saved searches, there's a dispatch.ttl of "2p".
* If the integer is followed by the letter 'p' Splunk interprets the ttl as a multiple of the scheduled search's execution period (e.g. if the search is scheduled to run hourly and ttl is set to 2p the ttl of the artifacts will be set to 2 hours).
Considering the above 2p , if the alert is scheduled for every 5 min then maybe the TTL is 10 min?
... View more