Is there a way to inspect an alert?

[danielbb]

A user tells us -

-- When we run a search for the last 10 hrs, we get about 5 results, but when we use the same search in the alert we received about 1000k duplicating alerts.

Is there a way to inspect an alert?

[gcusello]

Hi danielbb,
an alert is a search (like a report and a panel!), so you'll have the same results both in search and in alert if you set the same time range.
The only alert's difference is that, when you open an aler in search, you cannot modify time range.
To modify it, you have to open the alert in [Settings -- Searches, Reports and Alerts].
So check in this form what's the time range you're using.

Bye.
Giuseppe