Alert - Time interval

[monteirolopes]

Hi,

I am using the function:

| stats count(name) AS x by name | where x >4

Results:

name count(name)
Paul 10
John 3

I would like to receive alerts when the number of names (count(name)) is greater than 4 in a 5 minutes time interval, after five minutes, the count will reset and start count again.
This alert must be set in real time or Cron Scheduled time? How Can I define 5 minutes on Cron Expression?

Best Regards,
Monteiro.

[somesoni2]

If, you're ok with a delay of 5min to get the alert, run on Cron schedule time. Real-time alerts are expensive and they never complete. See @Cusello's answer for 5 min cron.

[gcusello · Accepted solution]

You have to configure an alert using your search with a time period of 5 minutes and schedule it with this cron definition

*/5 * * * *

Bye.
Giuseppe

[lyndac]

I believe the cron expression you are looking for is: 5 * * * *

[somesoni2]

Nopes... this is for running a search hourly at 5th min.

[lyndac]

Giuseppe is correct above, that is what I thought I typed, but apparently my fingers went another way.
Sorry. */5 * * * * is the correct one.