On Splunk cloud dashboard alert setup, how I can setup the alert email to be sent as soon as the incident occurs? is it possible change the "Alert type" from Scheduled to other type? All I can do seems to be setup a schedule only. Please help. Thank you.
Alerts go out as soon as the incident is detected. How long that takes depends on how long it takes for the incident to make its way into Splunk and also on how often the alert runs. Plus there's the latency in delivering the alert email.
I think your best option is to make the alert run more often, as long as it is able to complete before the next run time.
--- If this reply helps you, an upvote would be appreciated.