The "Expires" setting doesn't stop your alert from running after 24 hours. Your alert will continue to run daily indefinitely; the expiration only prevents repeated triggering within 24 hours of the last trigger, helping to avoid alert fatigue for ongoing issues.
Hope this helps.
If this helps, Upvote!!!!
Together we make the Splunk Community stronger
