https://community.splunk.com/t5/Reporting/Schedule-an-alert/m-p/293145#M5437 <P>Use earliest as <CODE>-1h@h</CODE> and latest as <CODE>@h</CODE></P> Thu, 23 Mar 2017 21:14:04 GMT somesoni2 2017-03-23T21:14:04Z https://community.splunk.com/t5/Reporting/Schedule-an-alert/m-p/293141#M5433 <P>How to schedule an alert to search for last hour data.<BR /> Ex: I have to schedule Alert to search for 9:00am-10:00am data. My Alert is scheduled at 15th min of every hour(15 */1 * * *). At 10:15 am, My alert runs, But I need it to search for last hour data(9-10am). what should be the earliest and the latest time settings?</P> Thu, 23 Mar 2017 20:21:11 GMT https://community.splunk.com/t5/Reporting/Schedule-an-alert/m-p/293141#M5433 ankithreddy777 2017-03-23T20:21:11Z https://community.splunk.com/t5/Reporting/Schedule-an-alert/m-p/293142#M5434 <P>Go to <CODE>Save As</CODE> in the upper right corner after you have a search in the search bar and select <CODE>Alert</CODE></P> <P>There will be 2 fields <CODE>Earliest</CODE> and <CODE>Latest</CODE></P> <P>The <CODE>Earliest</CODE> field should have <CODE>-1h@h</CODE><BR /> The <CODE>Latest</CODE> field should have <CODE>now</CODE></P> <P>This will set a 1 hour window of the previous hour </P> <P>You will also see the timeranges populate once you enter in those values</P> Thu, 23 Mar 2017 20:28:09 GMT https://community.splunk.com/t5/Reporting/Schedule-an-alert/m-p/293142#M5434 skoelpin 2017-03-23T20:28:09Z https://community.splunk.com/t5/Reporting/Schedule-an-alert/m-p/293143#M5435 <P>If I use latest time as now, then it will search for the data from 9:00-10:15 right? I just need 1 hr data</P> Thu, 23 Mar 2017 20:30:33 GMT https://community.splunk.com/t5/Reporting/Schedule-an-alert/m-p/293143#M5435 ankithreddy777 2017-03-23T20:30:33Z https://community.splunk.com/t5/Reporting/Schedule-an-alert/m-p/293144#M5436 <P>Just use earliest=-1h@h latest=@h to search from 9-10 (assuming a 10:15/30/45 search run time.<BR /> Details <A href="https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/SearchTimeModifiers">here</A></P> Thu, 23 Mar 2017 21:06:14 GMT https://community.splunk.com/t5/Reporting/Schedule-an-alert/m-p/293144#M5436 s2_splunk 2017-03-23T21:06:14Z https://community.splunk.com/t5/Reporting/Schedule-an-alert/m-p/293145#M5437 <P>Use earliest as <CODE>-1h@h</CODE> and latest as <CODE>@h</CODE></P> Thu, 23 Mar 2017 21:14:04 GMT https://community.splunk.com/t5/Reporting/Schedule-an-alert/m-p/293145#M5437 somesoni2 2017-03-23T21:14:04Z