Thanks to you both for your answers. That works great. However, when I create my alert based on the search, what do I choose for the 'Trigger If' setting? I presume I need to enter a custom condition. Do I enter 'MB > 100?'? If I chose 'No of Results' then wouldn't that just be the number of matched events rather than the Sum(MB)?
... View more