You can achieve this with a cron schedule: star/20 2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 star star star obviously, stars are the symbol... This schedule states that your search will fire every 20 minutes between 2am and 9pm, and will not fire outside those hours. You can then set your alert condition to be ‘if number of events is > 5’. This can be modified of course. Will that fit your use case?,You should be able to achieve this with a cron schedule: ... View more