Has anyone else seen an alert go out when it was not scheduled? I manually scheduled an alert to go out for testing, say 11:15am. Once verified, I scheduled that alert to go out at a specific time (8am, daily.) However, now I'm getting 2 alerts, one for my scheduled time (8am) and again at 11:15am.
The search was created in UI and scheduled from UI. I scheduled a cron to run at 11:15am to verify that it worked. Then I changed the schedule to ( 0 8 * * * ). It has been running for several days now but I'm getting 2 alerts daily: 1 at 8:15am and another at 11:15am.
I've scoured the filesystem and can find no evidence of where the ghost alert is coming from. The search exists in savedsearches.conf with the ( 0 8 * * * ) schedule.