I am trying to set up an alert based on time chart. My objective is to check user logins, and if no user logged in for 1 hour, send me alert. Also, I don't want to be sent an alert between 1am-5am because of the low traffic on my site during this time frame. This what I have tried, but not working.
index=mysite host=webserver* "user-loggedin" |where NOT (date_wday=monday OR date_wday=tuesday OR date_wday=wednesday OR date_wday=thursday OR date_wday=friday OR date_wday=saturday OR date_wday=sunday) AND (date_hour >=2 AND date_hour<=6) | timechart count as count span=1hr
The alert should trigger if the count less than 0.