https://community.splunk.com/t5/Alerting/search-and-alerts/m-p/121363#M1847 <P>I think you are making confusions about the <STRONG>schedule</STRONG> Alert. That <CODE>-24hr@h to now</CODE> is the Time Range for the search. For the schedule alert, you just need to specify a single time, like <CODE>* /5 * * * *</CODE> for example, to say that, after 5 minutes, your search will start and if the <STRONG>condition is true</STRONG>, the mail will be sent.</P> <P>Thanks</P> Fri, 22 May 2015 16:40:13 GMT stephanefotso 2015-05-22T16:40:13Z https://community.splunk.com/t5/Alerting/search-and-alerts/m-p/121362#M1846 <P>Hi,</P> <P>I have a search which is sceduled and should send an alert. I see it running on scheduled time from job inspector but says no search results found. but if I run same search manually (for last 24hrs) I see results. <BR /> The scheduled search is set to -24hr@h to now. Is "NOW" is the reason for not finding results or does it could be something else?<BR /> I changed the scheduled search to -24h@h to -1m@m to find if this is the reason but I just want to ask if anyone saw this issue?</P> <P>The same search worked yesterday but not today. Basically it looks like it is working sometimes and not other times.</P> <P>Thank You.</P> Fri, 22 May 2015 16:24:06 GMT https://community.splunk.com/t5/Alerting/search-and-alerts/m-p/121362#M1846 gudavasr 2015-05-22T16:24:06Z https://community.splunk.com/t5/Alerting/search-and-alerts/m-p/121363#M1847 <P>I think you are making confusions about the <STRONG>schedule</STRONG> Alert. That <CODE>-24hr@h to now</CODE> is the Time Range for the search. For the schedule alert, you just need to specify a single time, like <CODE>* /5 * * * *</CODE> for example, to say that, after 5 minutes, your search will start and if the <STRONG>condition is true</STRONG>, the mail will be sent.</P> <P>Thanks</P> Fri, 22 May 2015 16:40:13 GMT https://community.splunk.com/t5/Alerting/search-and-alerts/m-p/121363#M1847 stephanefotso 2015-05-22T16:40:13Z https://community.splunk.com/t5/Alerting/search-and-alerts/m-p/121364#M1848 <P>Hi Gudavasr,</P> <P>Hope below link can help you <BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/Alert/Definescheduledalerts">http://docs.splunk.com/Documentation/Splunk/6.2.3/Alert/Definescheduledalerts</A></P> Sat, 23 May 2015 14:36:00 GMT https://community.splunk.com/t5/Alerting/search-and-alerts/m-p/121364#M1848 neelamssantosh 2015-05-23T14:36:00Z