How to create an alert if failure increased in last 5 minutes?

[iqbalintouch]

Hi,

I want to create an alert which gets triggered if the failure count is more than 5 in last 5 minutes:

1- it should run on every 5 minutes
2- it should send an email as well

Here is base search and settings as well:

index=myindex sourcetype=xyz host=“tus3crs” "EventLogger*" AND "Purchase event" vertical=Stationary Type=Notebook (PurchaseStatus=510 OR PurchaseStatus=515 OR PurchaseStatus=530 OR PurchaseStatus=540) | dedup itemId sortBy -_time

NOTE- These status are different failure states of the item

Please help me with setting up this alert. thank you.

[richgalloway]

I've found it easiest to have the search test for the alert condition and have the alert trigger if the number of results is not zero. In this case,

index=myindex sourcetype=xyz host=“tus3crs” "EventLogger*" AND "Purchase event" vertical=Stationary Type=Notebook (PurchaseStatus=510 OR PurchaseStatus=515 OR PurchaseStatus=530 OR PurchaseStatus=540) 
| stats count by itemId 
| where count > 5

[iqbalintouch]

thank you @richgalloway , so that means the trigger condition in the screenshot not need to change..only base query require changes ?
please correct me.

[richgalloway]

The trigger condition does need to change from 5 to 0.

[iqbalintouch]

@woodcock hi,
if you can help, please.

thanks in advance.