I need to set up an alert condition to notify me if the report doesn't generate data for more than 5 minute's
stats max(_time) as "Last Report Run" by reltime|dedup "Last Report Run" |convert timeformat=%l:%M%p ctime("Last Report Run")|rename reltime as "Time Since Last Report"|sort -"Time Since Last Report"
Answering my own question: This result can be achieved by specifying the number or results as the trigger condition.
View solution in original post
@ryhluc01 If your problem is resolved, please accept the answer to help future readers.