https://community.splunk.com/t5/Alerting/real-time-search-alerting/m-p/38928#M452 <P>Thanks. Is there a way to have a "continuous" search running that only looks at recent events?</P> Mon, 20 May 2013 00:36:17 GMT a212830 2013-05-20T00:36:17Z https://community.splunk.com/t5/Alerting/real-time-search-alerting/m-p/38926#M450 <P>Hi,</P> <P>One of my customers enabled a real-time search and alerting that has started sending out thousands of messages. Some of these alerts are based upon data that is over a year old. The logs that provide this data were recently added, but I don't understand why old data would get triggered from a real-time search. </P> Sun, 19 May 2013 15:53:13 GMT https://community.splunk.com/t5/Alerting/real-time-search-alerting/m-p/38926#M450 a212830 2013-05-19T15:53:13Z https://community.splunk.com/t5/Alerting/real-time-search-alerting/m-p/38927#M451 <P>Because realtime searches search over all incoming data as it comes in in real time, regardless of the events' timestamps.</P> Sun, 19 May 2013 17:55:13 GMT https://community.splunk.com/t5/Alerting/real-time-search-alerting/m-p/38927#M451 Ayn 2013-05-19T17:55:13Z https://community.splunk.com/t5/Alerting/real-time-search-alerting/m-p/38928#M452 <P>Thanks. Is there a way to have a "continuous" search running that only looks at recent events?</P> Mon, 20 May 2013 00:36:17 GMT https://community.splunk.com/t5/Alerting/real-time-search-alerting/m-p/38928#M452 a212830 2013-05-20T00:36:17Z