The parameters you need to pass from dashboard A to dashboard B are form.t_time.* as that's the name of your time picker in dashboard B As I said in my initial reply, input elements in dashboard have the token names PREFIXED with form. so if you want to pass from a dashboard to another dashboard where the input field is populated from the passed URL parameters, you need to prefix the target token with form.

Most likely because the substitution is passing $ips$ as the string "a,c,x" and if you search for  | search ips IN ("a,c,x") you also get no results You could do it differently using where, for example this works | eval outer_ips=split($ips$, ",") | where ips=outer_ips or this | where match($ips$, ips) assuming your use case is IP addresses, the where option also allows for cirdmatch if that is useful.  

OK, please do the following 1. For that specific event, run your search for that time range and show what is the _indextime of your event index= "abc" "pace api iaCode - YYY no valid pace arrangementId as response!!!" OR "pace api iaCode - ZZZ no valid pace arrangementId as response!!!" source!="/var/log/messages" sourcetype=600000304_gg_abs_ipc2 | eval index_time=strftime(_indextime, "%F %T.%Q") | table _time index_time _raw 2. Then run this search for the time range 00:00 to 00:20 on that day index=_internal YOUR_ALERT_NAME sourcetype=scheduler and you should see details of the scheduler running your alert 3. HOW are you getting your alert? Is it being sent by email? If so, what is the SENT time of the email? Then from (1) you will see when the data is VISIBLE in Splunk from the index time for that event. That will show you if when the alert runs at 00:15 if the event is present in Splunk From (2) you will see the result count of the alert that runs From (3) you can see when the event was sent from Splunk I have suggested two times before that you change the time range of your search to look a little in the past to account for ingest lag - please can you ensure you are doing that, so set the search time range to be earliest=-16m@m latest=-1m@m in your alert time picker.  That will allow for 1 minute lag between event creation and index time