mail alert not functioning properly

[ayushmaan_22]

Hi all,

I made an alert which sends out mail to the respective teams whenever a high priority task has not been updated for more than an hour. The query is as follows:-

index="abc" INC* main_metric,

state="New" OR state="In Progress" OR state="Awaiting Third Party" OR state="Pending" priority = "1 - Critical" OR priority = "2 - High"

| rex field=_raw "main_metric=\"(?<main_metric>\S+\s\d+\:\d+\:\d+)\""

| dedup main_metric

| dedup number

| eval main_metric = upper(main_metric) 

| lookup lookup_inactivity_alert_distribution_list.csv assignment_group OUTPUT "Email_To" "Email_Cc" "Email_Bcc" "Enabled" 

| fillnull value=0

| search number != 0 AND Enabled = "Y" AND main_metric != 0

| eval end=strptime(main_metric, "%Y-%m-%d %H:%M:%S.%N")

| eval start=now()

| eval diff = start - end  

| lookup lookup_frequency_impact.csv impact output "Frequency1" "Frequency2" "Frequency3" "Frequency4" 

| eval freqdiff1 = Frequency1 + 600

| eval freqdiff2 = Frequency2 + 600

| eval freqdiff3 = Frequency3 + 600

| eval freqdiff4 = Frequency4 + 600

|eval result = case('caller_id' = "SCOM System" AND

'diff' >= 'Frequency3' AND  

'diff' <= 'freqdiff3',"outcome1",'caller_id' != "SCOM System" AND 'diff' >= 'Frequency1' AND

'diff' <= 'freqdiff1',"ouitcome2",'caller_id' != "SCOM System" AND 'diff' >= 'Frequency2' AND

'diff' <= 'freqdiff2',"outcome3",'caller_id' != "SCOM System" AND 'diff' >= 'Frequency3' AND

'diff' <= 'freqdiff3',"outcome4",'caller_id' != "SCOM System" AND 'diff' >= 'Frequency4' AND

'diff' <= 'freqdiff4',"outcome5",1==1,"no outcome")

| search result="outcome1" OR result="outcome2" OR result="outcome3" OR result="outcome4" OR result="outcome5" AND state!="Closed"

| table  main_metric priority caller_id result assignment_group u_updated_on "Email_To" Email_Cc Email_Bcc number start end diff Frequency1 Frequency2 Frequency3 Frequency4

| map alert_main_metric_mail assignment_group="$assignment_group$" to="$Email_To$" cc="$Email_cc$" bcc="$Email_Bcc$"

The second lookup handles the frequency with which the alert emails are to be sent with respect to the priority of the ticket. Now the problem that I am having is that if the ticket or task is closed within half an hour of it being created, the alert is still generated. Even if the ticket is de-escalated, the alert is still being received. I tried many modifications in the code but nothing seems to work. Could you all help me with this bug?

P.S.: The map commands connect just the saved search which sends out the emails with the appropriate subject and description.