You might have over 1 minute of indexing / event latency.
Try this in your search instead:
This will go by the time it was indexed and not by the date timestamp in the events.
It is a best practice to have a "trailing" search for these types of alerts. Something like this would search for the minute of time from 10 minutes ago, and would be more likely to find the events that are latent.
index=snmp earliest=-11m@m latest=-10m@m
Play with _index_earliest, _index_latest, earliest and latest a little and I think you'll solve your problem.
Here's a good write up on the issue I think you're facing: