https://community.splunk.com/t5/Alerting/Custom-alert-trigger-condition-for-passing-time-amount/m-p/441685#M7735 <P>Hi all, </P> <P>I need to set up an alert condition to notify me if the report doesn't generate data for more than 5 minute's </P> <P>stats max(_time) as "Last Report Run" by reltime|dedup "Last Report Run" |convert timeformat=%l:%M%p ctime("Last Report Run")|rename reltime as "Time Since Last Report"|sort -"Time Since Last Report" </P> Wed, 19 Dec 2018 21:57:25 GMT ryhluc01 2018-12-19T21:57:25Z https://community.splunk.com/t5/Alerting/Custom-alert-trigger-condition-for-passing-time-amount/m-p/441685#M7735 <P>Hi all, </P> <P>I need to set up an alert condition to notify me if the report doesn't generate data for more than 5 minute's </P> <P>stats max(_time) as "Last Report Run" by reltime|dedup "Last Report Run" |convert timeformat=%l:%M%p ctime("Last Report Run")|rename reltime as "Time Since Last Report"|sort -"Time Since Last Report" </P> Wed, 19 Dec 2018 21:57:25 GMT https://community.splunk.com/t5/Alerting/Custom-alert-trigger-condition-for-passing-time-amount/m-p/441685#M7735 ryhluc01 2018-12-19T21:57:25Z https://community.splunk.com/t5/Alerting/Custom-alert-trigger-condition-for-passing-time-amount/m-p/441686#M7736 <P>Answering my own question: This result can be achieved by specifying the number or results as the trigger condition. </P> Wed, 26 Dec 2018 16:31:50 GMT https://community.splunk.com/t5/Alerting/Custom-alert-trigger-condition-for-passing-time-amount/m-p/441686#M7736 ryhluc01 2018-12-26T16:31:50Z https://community.splunk.com/t5/Alerting/Custom-alert-trigger-condition-for-passing-time-amount/m-p/441687#M7737 <P>@ryhluc01 If your problem is resolved, please accept the answer to help future readers.</P> Wed, 26 Dec 2018 18:51:39 GMT https://community.splunk.com/t5/Alerting/Custom-alert-trigger-condition-for-passing-time-amount/m-p/441687#M7737 richgalloway 2018-12-26T18:51:39Z