Splunk alerts are fundamentally saved searches configured to run automatically and trigger an action when specific conditions are met. The scheduling mechanism for these searches is flexible, allowing them to be executed either at regular, predefined intervals (e.g., every hour, every Monday at 9 AM) or in real-time. A real-time alert runs continuously, evaluating events as they are indexed and triggering immediately when its conditions are satisfied. This dual capability allows administrators to monitor for both historical trends and immediate, critical events.

B. Alerts can trigger a wide variety of actions beyond email, including running scripts, logging events, sending webhooks, or creating tickets in other systems.
C. Splunk uses its own internal scheduler to run alerts. While it supports cron-like syntax for scheduling, it does not depend on the underlying operating system's cron daemon.
D. Alerts are not exclusively real-time. They can be configured to run on a scheduled basis (e.g., hourly, daily) to check for conditions over historical data.

1. Splunk Enterprise Documentation

Alerting Manual

"Getting started with alerts": "Alerts are based on saved searches. You can set up alerts to trigger when search results meet specific conditions. You can create alerts on historical or real-time searches." This directly confirms that alerts can be either scheduled (historical) or real-time.

2. Splunk Enterprise Documentation

Alerting Manual

"Configure alerts in Splunk Web"

"Alert type" section: This section explicitly details the two primary alert types: "Scheduled" and "Real-time". It states

"A scheduled alert runs a search on a regular schedule... A real-time alert runs a search continuously in the background." This validates the core premise of the correct answer.

3. Splunk Enterprise Documentation

Alerting Manual

"Set up alert actions": This chapter provides a comprehensive list of default alert actions

including "Log event

" "Run a script

" "Send email

" and "Use a webhook

" which directly refutes the claim that alerts can only send email notifications.