Hi @josephjohn2211, I suppose that you have these information in an index and when you say "table" you're speaking of an index, if not, please correct me. Anyway, if you already extracted fields (c...
See more...
Hi @josephjohn2211, I suppose that you have these information in an index and when you say "table" you're speaking of an index, if not, please correct me. Anyway, if you already extracted fields (called timestamp, InProgress and NotYetStarted), you have to create a search checking the presence of values in the three fields to trigger when they are empty, something like this. index=ACTUAL_END_TIME NOT (InProgress=* NotYetStarted=*) If you have results the alert triggers. The alert must start to trigger at 7.00 but at what hour it must stop? in my sample I use 18:00, so you can schedule the alert using this cron expression: */30 7-18 * * * Please, if possible, avoid to use spaces, dots or special chars (as "-") in you field names, otherwise you have to use quotes for those fields. If instead you didn't extract fields, you should share some sample (both of rows with the three fields and without them) so I can help you. Ciao. Giuseppe