Splunk Alert search time latest=-5m@m OR latest=now

[Flenwy]

Hello everyone,

I'm currently setting up a lot of alarms in Splunk, and a question has arisen regarding what is better in terms of time.

We've considered two scenarios:

1. latest=-5m@m
2. latest=now
   
   

If I run the alarm every 5 minutes, I naturally want to avoid having "gaps" in my search. 
I thinks both options will work but iam not 100% sure.

I appreciate any insights on this.

Thank you.

[Flenwy]

Hello @ITWhisperer,

thank you a lot for this good explanation.
Now i know where to look at.

Kind regards,
Flenwy

[ITWhisperer · Accepted solution]

It depends on what your earliest is and how quickly your events are indexed, and what timestamps are used on your events.

For example, some systems such as Apache HTTPD often log with a timestamp which represents when the request was received, but it is only written when the response is sent, so an event which takes more than say 5 minutes, may not show up in your search if you are only looking back 5 minutes every 5 minutes.