Hello
I have an alert that runs every 2 minutes for the last 40 hours of data. I use five different logs to retrieve the result I need using the join command. The throttle is set on, suppressing the results for 40 hours in order to suppress the repeating alert.
My alert runs perfectly and triggers on time. But every three to four months once, I get the delayed alert for some hours. This issue was repeating for every three to four months, So I had an alternative alert running. Now one of the alert gets delayed for 4 hours and an other one was on time. It makes the alert less reliable.
I started to monitor the triggered alerts in Triggered alerts section. Note: It's a very big query takes 30 seconds.
May I know the possible reason for this and best practices to avoid this error in future? How to identify the issue?
