We have a need to schedule an alert to run every 5 minutes. How can we ensure that the scheduled alert will not miss any unindexed data due to its high frequency?
Adjust your window of events back a few seconds to allow for events in flight. For example, earliest=-6m latest=-1m
will search the -minute period that ended a minute ago. That's usually good enough.
BTW, 5 minutes is not that high a frequency. We run many searches at 1-minute intervals, looking at the previous minute.