If you were to make two copies of the alert search and schedule them with cron, you could have different alert actions for each one. For example set one with a cron schedule of
cron_schedule = */2 9-17 * * *
to alert every half hour from 9am to 5:30pm and email the helpdesk. Another with cron of
cron_schedule = */2 0-8,18-24 * * *
to alert from 6pm to 8:30 and run a script to page the on call person.
Another option would be to run one report inside of Splunk but trigger an external script that performs whatever alerting actions you need. That script could also check the time of day.