Thanks @niketnilay; I believe that should do it. I wasn't aware of the streamstats command; it looks like what I'm after is almost exactly what is shown in example 8 of the documentation of it as well! ... View more

From the result set returned by the rest api call, is there a way to identify which are alerts and which are reports? ... View more

You may be running into timeout issues of various kinds, as well as, potentially, out-of-memory issues. It would seem to be a more scalable approach, although a PITA to redo all the architecture, to send those all to a summary index as they are generated. Since that would require a bunch of mantime, just check whether your above strategy would work correctly for, say, the last 15 minutes. If it does, then run it every 15 minutes to send the results to a summary index, and you can scan the summary index to see what happened over the last day. ... View more

The by _time span=60m will break up all of history into 60 minute chunks and report if ANY of them are below 900K. Just use earliest=-1h . ... View more