If an alert is scheduled for every 30 minutes to look back 30 minutes, does it search since the last report's idea of what "now" was, or does it just do current "now" minus 30 minutes?
The reason I ask is to know if alert conditions can be missed if they occur JUST AFTER a previous report was run, and CPU utilization or other situation delays the next report from running by a few seconds. If the report just goes back 30 minutes from then execution of the scheduled search, these just-after events would be missed.
Must I take precautions such as looking back 35 minutes for a 30 minute period? What is the behavior for alert conditions that are found in two consecutive scheduled searches?
Yes if you schedule a search to run every 30 min, it uses the current now each time though in later versions they use cron style timing so it is less of an issue. Splunk recommend allowing a generous 5 min for this in the alert scheduling. So in your case you would run the alert every 30 minutes from 35 min ago until 5 min ago.
If you want the report to show clean half hour blocks, schedule it to run at 5 past and 25 to the hour using custom/cron as