You can set this as a custom alert condition: stats sum(count) as sum | where sum > 10 ... View more

For charting over time you usually want to use timechart like so: ... | timechart span=1h count ... View more