We have an alert that runs every 5 minutes. The search searches between -6 minutes and -1 minute.
When this search gets deferred, will the time frame be in the context of when it was actually run or in the context of when it should have ran?
If I understand your question correctly you have a search with relative as : -6m@m and -1m@m. If thats the case then as this is relative to time so the context is the time at which it executes.
If I understand your question correctly you have a search with relative as : -6m@m and -1m@m. If thats the case then as this is relative to time so the context is the time at which it executes.