The time ranges are two different things. The earliest and latest you set for the alert and in the regular time range picker filters for the event's time, the _time field. _index_earliest and _index_latest filters for the event's indexing time, the _indextime field.
Why does that distinction matter?
Say you want to alert every minute, for the previous minute. A search might run at 11:12:00, searching from 11:11:00 to just before 11:12:00. If an event is generated at 11:11:59 it might arrive in Splunk at 11:12:01 so this search won't find it... and neither will the next search, because it's out of that time range by then.
The lazy fix would be to add a bit of a delay, e.g. earliest=-2m@m to latest=-m@m , but that can only work if you know your maximum indexing delay and your maximum indexing delay is short.
The proper fix would be to largely ignore _time , e.g. earliest=-3d to latest=+d , and primarily filter by indexing time, e.g. _index_earliest=-2m@m to _index_latest=-m@m . That way your primary filter isn't affected by indexing delay, and every incoming event will be looked at by the alert exactly once. Adjust the -3d as fit for your environment.
... View more