Scheduled alert to retrieve latest event indexed every five minutes

[fatjoe]

I have a search query which uses dedup to get the latest event from my source type.

Search:
sourcetype = MonitorLog | dedup Username | WHERE SecondsElapsed >= 300

Username, AllocatedDirectorySize,UsedDirectorySize,PercentageUsage,LatestFileCreationTime,TimeElapsed,SecondsElapsed
amiro,300,314,105%,5/17/2017 12:01:30 PM,"0 days, 0 hours, 7 minutes, 15 seconds",435.0344144
safcom,900,907,101%,5/17/2017 11:50:18 AM,"0 days, 0 hours, 5 minutes, 6 seconds",306.0829872

How do I set up a scheduled alert which will be running this search and trigger alert when event is returned.

I have used the below but its not working.

Earliest: +0m@m
Latest: +5m@m
Cron expression: */5 * * * *

Any suggestions?

[DalJeanis]

Your query gets the latest event for each Username, only if SecondsElapsed > 300. Looks okay.

Your cron setup, however, is looking for every event from the start of this minute to the start of five minutes from now. You are looking for future events.

Try this -

Earliest: -5m@m
Latest: -0m@m
Cron expression: /5 

[DalJeanis]

Also, it would be worth leaving a couple of minutes in there for indexing to occur.

 Earliest: -7m@m
 Latest: -2m@m
 Cron expression: 2/5 * * * *  

[somesoni2]

The full cron will be 2/5 * * * *

[DalJeanis]

Yeah, I got lazy...

I hate having to look up whether a particular implementation is five or six slots...

Darn Oracle with their seconds-level precision...even though things seldom run in a second...