How to ensure a frequently scheduled alert does not miss any unindexed data?

[jlimlogic]

We have a need to schedule an alert to run every 5 minutes. How can we ensure that the scheduled alert will not miss any unindexed data due to its high frequency?

[richgalloway]

Adjust your window of events back a few seconds to allow for events in flight. For example, earliest=-6m latest=-1m will search the -minute period that ended a minute ago. That's usually good enough.

BTW, 5 minutes is not that high a frequency. We run many searches at 1-minute intervals, looking at the previous minute.