I have a search which is sceduled and should send an alert. I see it running on scheduled time from job inspector but says no search results found. but if I run same search manually (for last 24hrs) I see results.
The scheduled search is set to -24hr@h to now. Is "NOW" is the reason for not finding results or does it could be something else?
I changed the scheduled search to -24h@h to -1m@m to find if this is the reason but I just want to ask if anyone saw this issue?
The same search worked yesterday but not today. Basically it looks like it is working sometimes and not other times.
I think you are making confusions about the schedule Alert. That
-24hr@h to now is the Time Range for the search. For the schedule alert, you just need to specify a single time, like
* /5 * * * * for example, to say that, after 5 minutes, your search will start and if the condition is true, the mail will be sent.