Splunk SPLK-5002 Exam - Topic 3 Question 31 Discussion

The issue is ingestion latency. Event 2 occurs at 5:24 but is not indexed until 5:35. The 5:30 scheduled search covers event time 5:00--5:30, but the event is unavailable when that search executes. By the next execution at 6:00, the search window has advanced to 5:30--6:00, so an event timestamped 5:24 can fall outside the new window even though it is now searchable.

The solution is to increase the detection's lookback window sufficiently to accommodate expected indexing delay. Operationally, scheduled detections frequently use overlapping windows---for example, executing every 30 minutes while looking back farther than 30 minutes---to prevent late-arriving events from being missed. Appropriate deduplication or throttling can then address repeated matches caused by overlap.

Decreasing the time window would make the latency problem worse. The scenario also does not indicate that an excessively large window is causing duplicate alerts; it demonstrates a late-arriving event that misses the search interval.

Study Guide topics: detection scheduling, ingestion latency, event time versus index time, lookback windows, late-arriving telemetry.