Hi,
I am using the function:
| stats count(name) AS x by name | where x >4
Results:
name count(name)
Paul 10
John 3
I would like to receive alerts when the number of names (count(name)) is greater than 4 in a 5 minutes time interval, after five minutes, the count will reset and start count again.
This alert must be set in real time or Cron Scheduled time? How Can I define 5 minutes on Cron Expression?
Best Regards,
Monteiro.
You have to configure an alert using your search with a time period of 5 minutes and schedule it with this cron definition
*/5 * * * *
Bye.
Giuseppe
If, you're ok with a delay of 5min to get the alert, run on Cron schedule time. Real-time alerts are expensive and they never complete. See @Cusello's answer for 5 min cron.
You have to configure an alert using your search with a time period of 5 minutes and schedule it with this cron definition
*/5 * * * *
Bye.
Giuseppe
I believe the cron expression you are looking for is: 5 * * * *
Nopes... this is for running a search hourly at 5th min.
Giuseppe is correct above, that is what I thought I typed, but apparently my fingers went another way.
Sorry. */5 * * * *
is the correct one.