Changing the timestamp offset

The size of this offset depends on how frequently these alerts are scheduled, and how long the lag is between the start of analysis and when the documents are saved to the index. These settings are used by all alert groups.

See Also
Define timestamp offsets for incremental alerts (Optional)
  1. Select Misc > Configuration > Alerting.
  2. Under Incremental mode, change the Timestamp offset(s) value.