I am new to splunk, I have setup a hourly alert in Splunk ML toolkit. Alert runs from 8am and the trigger condition matches and an email is triggered(expected behaviour). But when it again runs at 9am (and later) it is reading the result from previously executed results.
Search query at 9 am looks like this,
| loadjob scheduler__xxxxxxxx | head 1 | tail 1
Alert config:
Cron expression : 00 8-22 * * 1-5
Trigger conditions: Number of Results greater than 0.
And Trigger Once
(Throttle not selected)
Can someone suggest why the old result is considered instead of running the base query again.
