How to receive a alert when job gets fail?

[arunpt92]

index="db_oracle-prod" source="AzureVOCprod" status=4
| eval MSGStatus=case(status=1,"CREATED", status=2,"RUNNING", status=3,"CANCELLED", status=4,"Failed", status=5,"PENDING", status=6,"ENDED UNEXPECTEDLY", status=7,"SUCCEEDED",status=8,"STOPPING", status=9,"COMPLETED")
| join package_name [inputlookup Azure_VOC.csv]
| eval STARTTime=strptime((strftime(now(),"%Y-%m-%d")),"%Y-%m-%d") - strptime(start_time,"%Y-%m-%d")
| where STARTTime=0
| stats count by Azure_Pipeline_name, start_time, end_time, MSGStatus

receiving record every 15mins instead we should have only failure ones based on timeframe

[richgalloway]

What are the earliest and latest settings for the alert?  How often does it run?  Is throttling enabled?

[arunpt92]

Our first job starts at 11.30AM IST and ends at 6.30PM IST. Should get an alert if job gets fails. But we are getting on data getting record every 15mins instead we should have only 1 or 2 records

[richgalloway]

I wasn't asking for the time range of when the alert runs, but the time range the alert searches.  It will in the dispatch.earliest and dispatch.latest fields in savedsearches.conf or rest /services/saved/searches.

If the alert runs every 15 minutes and searches more than 15 minutes of events then results will be repeated.