How to hide past events in the FIRST alert with -2h time window

[ibob0304]

My alert runs at 8 AM, 10 AM, 12 PM daily when count < 500 , with a time frame of -2h@h to now.

So, at 8 AM report it shows stats from 6 AM to 8 AM because I gave as -2h@h.
At 10 AM, it shows the records from last 2 hours (8 AM to 10 AM).
At 12 PM, it shows the last -2 hours which is 10 AM to 12 PM.

Now, I want to hide the past 8 AM results in the first 8 AM alert. Like when it trigger at 8 AM first time in a day, it should not show 6 AM records count in it. it should only show 8 AM count.

Above logic should apply only for the first alert. 10 AM & 12 PM alerts should show all past -2h count like normal.

[Sukisen1981 · Accepted solution]

Hi,

You need to modify the search on which your alert is based.`

your search| eval x=substr(strftime(_time,"%Y-%m-%d %H"),12,2)|eval count=if(x<8,0,count)

Now, all counts less than 8 will return 0 , assuming your alert condition is based on the count value , it will take all values for times below 8 AM as 0 but work for all values greater than equal to 8.
BTW your alert condition in count <500 or count >500?