Alerting

If a scheduled alert is deferred that searches between -6 and -1 minutes, will the time range be in the context of when it was run or when it should have ran?

Path Finder

We have an alert that runs every 5 minutes. The search searches between -6 minutes and -1 minute.

When this search gets deferred, will the time frame be in the context of when it was actually run or in the context of when it should have ran?

0 Karma
1 Solution

Contributor

If I understand your question correctly you have a search with relative as : -6m@m and -1m@m. If thats the case then as this is relative to time so the context is the time at which it executes.

View solution in original post

Contributor

If I understand your question correctly you have a search with relative as : -6m@m and -1m@m. If thats the case then as this is relative to time so the context is the time at which it executes.

View solution in original post