How many minutes, by default, is the time to live (ttl) for an ad-hoc search job?
Given the following SPL search, how many rows of results would you expect to be returned by default? index=security sourcetype=linux_secure (fail* OR invalid) I top src__ip