Alerts go out as soon as the incident is detected. How long that takes depends on how long it takes for the incident to make its way into Splunk and also on how often the alert runs. Plus there's the latency in delivering the alert email.
I think your best option is to make the alert run more often, as long as it is able to complete before the next run time.
---
If this reply helps you, Karma would be appreciated.
