index=rest because the offer is shutoff. partnerId="*" host="*-prd-rst*" | stats count by partnerId,offerId | lookup partneridlookup partnerId OUTPUT RetailerName |sort count DESC
In the timeframe, I have chosen "Relative - 2 hours Ago". The alert is set on a cron as 0 */2 * * * [to run every two hours].
For some reason, every time this Alert is triggered, timeframe run is for "All time". It does on run for the 2 hours window provided.
The issue seems to be only with this Alert. My other Alerts work fine. Any pointers would be helpful.