search and alerts

[gudavasr]

Hi,

I have a search which is sceduled and should send an alert. I see it running on scheduled time from job inspector but says no search results found. but if I run same search manually (for last 24hrs) I see results.
The scheduled search is set to -24hr@h to now. Is "NOW" is the reason for not finding results or does it could be something else?
I changed the scheduled search to -24h@h to -1m@m to find if this is the reason but I just want to ask if anyone saw this issue?

The same search worked yesterday but not today. Basically it looks like it is working sometimes and not other times.

Thank You.

[neelamssantosh]

Hi Gudavasr,

Hope below link can help you
http://docs.splunk.com/Documentation/Splunk/6.2.3/Alert/Definescheduledalerts

[stephanefotso]

I think you are making confusions about the schedule Alert. That -24hr@h to now is the Time Range for the search. For the schedule alert, you just need to specify a single time, like * /5 * * * * for example, to say that, after 5 minutes, your search will start and if the condition is true, the mail will be sent.

Thanks