Alerts timing

[poddraj]

Hi

I am trying to create an alert when there are more than 10 login attempt failures by same user in last 15 mins. I have scheduled my cron to run for every 15 mins

However, I have a scenario where there were 8 login failures at 8:59 and another 5 at 9:01 for same user
if we run the cron at 9 and 9:15, neither of them would alert.

Is it possible to manipulate some of splunk's alert options to get the behavior I want?

[The_Simko]

It's a matter of defining your boundaries, and what your goals are.
One way to do what you want is to run the alert every 5 minutes for the previous 15 minutes.  That way your condition will be less likely to be missed.
  
Now, you will get some duplicate alerts. You can either just accept it as the cost of being vigilant, or you could do something fancy like write the box name or account name (or both) to a lookup, then query that to make sure it hasn't fired already before sending the alert.