Do you mean you want to schedule a two-week lookback to run daily?
That is pretty straightforward – build the Alert/Report, save it, set proper permissions, and then schedule it to send an email (or whatever) every day
July 31, 2020 at 11:20AM
via reddit https://www.reddit.com/r/Splunk/comments/i18u05/i_want_to_run_a_14_day_search_but_only_alert_on/fzvf7b1?utm_source=ifttt