Ambiguous behavior of Splunk Alert

[sarvesh_11]

I am getting alert in splunk, when i click the hyperlink "View Result in Splunk",
it is giving me the same what is there in the mail body.
But when i again run the same code for same time window, there is nothing, i.e just hit , the results disappear?
Also, they are false alerts. the correct output is shown when we are rerunning the query.

Now this is frightening, and looses confidence on Splunk. Though its not happening in repetitive manner, its unusual.
My code is :

| makeresults
| eval Field1="1,2,3,4,5"
| eval Field1=split(Field1,",")
| mvexpand Field1
| join type=left Field1
[ search index=x source="abc"(my source is database)
....]

and the code goes onn.
@gordo32 i have seen your inputs on this https://answers.splunk.com/answers/305369/why-the-results-from-triggered-alert-is-different.html. Do you think the "search" will also resolve my thing?

[jawaharas]

Are you using relative time (say last 15 min, last 1 hour etc.,) for your search?

[sarvesh_11]

@jawaharas Yes i am using Last 15minutes as time window and cron schedule of every 5minutes.

[jawaharas]

Is your issue replicable when using absolute time range (from 'timerange' picker, select 'Date & Time Range) instead of relative time (last 15 min) ?

Also, can you share your full Splunk query?

[sarvesh_11]

yes, it is replicable!
I am sorry, i cannot share the whole query.
I found something intereting in: https://answers.splunk.com/answers/305369/why-the-results-from-triggered-alert-is-different.html

Using "search" in alert was creating a problem, thankfully i get rid of it 🙂