Alert period overlap?

[cyfj]

If an alert is scheduled for every 30 minutes to look back 30 minutes, does it search since the last report's idea of what "now" was, or does it just do current "now" minus 30 minutes?

The reason I ask is to know if alert conditions can be missed if they occur JUST AFTER a previous report was run, and CPU utilization or other situation delays the next report from running by a few seconds. If the report just goes back 30 minutes from then execution of the scheduled search, these just-after events would be missed.

Must I take precautions such as looking back 35 minutes for a 30 minute period? What is the behavior for alert conditions that are found in two consecutive scheduled searches?

Thanks!

[Splunk_U]

I want to run a particular search on every 15 mins like 9:00, 9:15, 9:30 9:45 in this way. How to do that?

[Eqalis]

Yes if you schedule a search to run every 30 min, it uses the current now each time though in later versions they use cron style timing so it is less of an issue. Splunk recommend allowing a generous 5 min for this in the alert scheduling. So in your case you would run the alert every 30 minutes from 35 min ago until 5 min ago.

If you want the report to show clean half hour blocks, schedule it to run at 5 past and 25 to the hour using custom/cron as

5,35 * * * *

Bob

[Eqalis]

Consecutive searches are not compared unless you chose to alert only if a count rises or drops by a value. So if you are not careful, you will get duplicate data

[cyfj]

Thanks! Is the same entry returned in two consequtive runs treated any differently the second time, related to emailed alerts?