topic Re: Alert - Time interval in Alerting

Alert - Time interval

monteirolopes — Fri, 30 Sep 2016 12:48:26 GMT

Hi,

I am using the function:

| stats count(name) AS x by name | where x >4

Results:

name count(name)
Paul 10
John 3

I would like to receive alerts when the number of names (count(name)) is greater than 4 in a 5 minutes time interval, after five minutes, the count will reset and start count again.
This alert must be set in real time or Cron Scheduled time? How Can I define 5 minutes on Cron Expression?

Best Regards,
Monteiro.

Re: Alert - Time interval

lyndac — Fri, 30 Sep 2016 13:09:50 GMT

I believe the cron expression you are looking for is: 5 * * * *

Re: Alert - Time interval

gcusello — Fri, 30 Sep 2016 13:40:48 GMT

You have to configure an alert using your search with a time period of 5 minutes and schedule it with this cron definition

*/5 * * * *

Bye.
Giuseppe

Re: Alert - Time interval

somesoni2 — Fri, 30 Sep 2016 16:02:58 GMT

Nopes... this is for running a search hourly at 5th min.

Re: Alert - Time interval

somesoni2 — Fri, 30 Sep 2016 16:04:07 GMT

If, you're ok with a delay of 5min to get the alert, run on Cron schedule time. Real-time alerts are expensive and they never complete. See @Cusello's answer for 5 min cron.

Re: Alert - Time interval

lyndac — Fri, 30 Sep 2016 16:16:16 GMT

Giuseppe is correct above, that is what I thought I typed, but apparently my fingers went another way.
Sorry. */5 * * * * is the correct one.