Custom alert trigger condition for passing time amount

[ryhluc01]

Hi all,

I need to set up an alert condition to notify me if the report doesn't generate data for more than 5 minute's

stats max(_time) as "Last Report Run" by reltime|dedup "Last Report Run" |convert timeformat=%l:%M%p ctime("Last Report Run")|rename reltime as "Time Since Last Report"|sort -"Time Since Last Report"

[ryhluc01 · Accepted solution]

Answering my own question: This result can be achieved by specifying the number or results as the trigger condition.

[richgalloway]

@ryhluc01 If your problem is resolved, please accept the answer to help future readers.