If a scheduled alert is deferred that searches between -6 and -1 minutes, will the time range be in the context of when it was run or when it should have ran?

[saulverde]

We have an alert that runs every 5 minutes. The search searches between -6 minutes and -1 minute.

When this search gets deferred, will the time frame be in the context of when it was actually run or in the context of when it should have ran?

[jensonthottian · Accepted solution]

If I understand your question correctly you have a search with relative as : -6m@m and -1m@m. If thats the case then as this is relative to time so the context is the time at which it executes.