https://community.splunk.com/t5/Alerting/Question-regarding-timeframes-and-behaviour-of-delayed-alerts/m-p/387119#M6801 <BLOCKQUOTE> <P>When I schedule a search in Splunk to run at 0:00 and let’s say select the timeframe in the alert of -6h to now. What happens if due to technical issues the search is delayed and runs at 6 AM? Will it now search from 0:00 to 6:00 instead?</P> </BLOCKQUOTE> <P>Yes</P> <BLOCKQUOTE> <P>When a search is delayed, will the now() command in the search refer back to the “old” scheduled date or will it accordingly use the date of runtime?</P> </BLOCKQUOTE> <P><CODE>now</CODE> is always the time the search runs, not when it was scheduled.</P> <BLOCKQUOTE> <P>What happens if you schedule a hourly search but due to technical issues no search can run in a 90m time window. Will the delayed search run together with the next search or will it be skipped?</P> </BLOCKQUOTE> <P>The search will be skipped.</P> Sun, 26 May 2019 14:12:14 GMT richgalloway 2019-05-26T14:12:14Z https://community.splunk.com/t5/Alerting/Question-regarding-timeframes-and-behaviour-of-delayed-alerts/m-p/387118#M6800 <P>Heyho!</P> <P>I am currently working on putting together a summary index and would like to do it via an alert.<BR /> The basics are all clear on how to set an alert, scheduling, writing into the index and so on.<BR /> However I haven’t been able to find any best practice info here and info on how splunk behaves on delayed alerts (not delayed indexing).</P> <P>So the Alert I am setting up (and this is already working in a csv) is doing a search for 6h which is at least full 24h ago, and it snaps to the last completed 6h batch of the previous day ( 0,6,12,18). So if you run a search on the 26. of May at 6:01 or at 11:55 it will automatically search for the timeframe of 25. May at 0:00 to 6:00. And that’s all fine in itself, no assistance needed.</P> <P>What I do not know though is how splunk alerts usually behave.<BR /> When I schedule a search in Splunk to run at 0:00 and let’s say select the timeframe in the alert of -6h to now. What happens if due to technical issues the search is delayed and runs at 6 AM? Will it now search from 0:00 to 6:00 instead?<BR /> When a search is delayed, will the now() command in the search refer back to the “old” scheduled date or will it accordingly use the date of runtime?<BR /> What happens if you schedule a hourly search but due to technical issues no search can run in a 90m time window. Will the delayed search run together with the next search or will it be skipped?</P> <P>With using these 6h intervals I mentioned before in my plans, do you think that all issues are minimized as far as it gets or do you have any other recommendations?</P> Sun, 26 May 2019 08:19:48 GMT https://community.splunk.com/t5/Alerting/Question-regarding-timeframes-and-behaviour-of-delayed-alerts/m-p/387118#M6800 Bastelhoff 2019-05-26T08:19:48Z https://community.splunk.com/t5/Alerting/Question-regarding-timeframes-and-behaviour-of-delayed-alerts/m-p/387119#M6801 <BLOCKQUOTE> <P>When I schedule a search in Splunk to run at 0:00 and let’s say select the timeframe in the alert of -6h to now. What happens if due to technical issues the search is delayed and runs at 6 AM? Will it now search from 0:00 to 6:00 instead?</P> </BLOCKQUOTE> <P>Yes</P> <BLOCKQUOTE> <P>When a search is delayed, will the now() command in the search refer back to the “old” scheduled date or will it accordingly use the date of runtime?</P> </BLOCKQUOTE> <P><CODE>now</CODE> is always the time the search runs, not when it was scheduled.</P> <BLOCKQUOTE> <P>What happens if you schedule a hourly search but due to technical issues no search can run in a 90m time window. Will the delayed search run together with the next search or will it be skipped?</P> </BLOCKQUOTE> <P>The search will be skipped.</P> Sun, 26 May 2019 14:12:14 GMT https://community.splunk.com/t5/Alerting/Question-regarding-timeframes-and-behaviour-of-delayed-alerts/m-p/387119#M6801 richgalloway 2019-05-26T14:12:14Z