Hello all, I have some questions concerning the scheduling of detections. How do the rolling window for alerts work ? Does the time range starts when an awaited event from the search is received ? for example for a basic search like "index = foo data = foo | stats count | where count > 3" Is it possible to configure it for ES detections ? It is documented for alerts in Splunk Enterprise (https://help.splunk.com/en/splunk-enterprise/alert-and-respond/alerting-manual/9.4/create-alerts/create-real-time-alerts) however the way it works and for which alerts is not detailed. What is the difference between scheduled and real-time detections ? My real-time detections need to have a cron schedule defined while it is mentionned here that both are possible https://help.splunk.com/en/splunk-enterprise/alert-and-respond/alerting-manual/9.0/manage-alert-trigger-conditions-and-throttling/configure-alert-trigger-conditions  Thank you for any information you can provide. Have a nice day !  ... View more