We are not clear how the Auto Window is being calculated.
At Making the Most of the Splunk Scheduler
We see -
How exactly this auto window is being calculated?
You are correct. A scheduled search needs a history before Splunk can set an auto window.
The way I read it -
Let's say the Period (P) is 5 minutes, Runtime (R) is 2 minutes, then Window (W) would be 5 - 2 = 3.
Meaning, anytime within these 3 minutes, can be used by the scheduler to start the search.
I guess R is derived from pervious runs.