Answer by warren for Alert setting, in case of a large interval between messages

Posted on

Something like this should work:

index=ndx sourcetype=srctp srcMsgId=* system=*
| stats min(_time) as early max(_time) as late by srcMsgId system
| where (late-early)>N

Use a value (in seconds) for "N" – like | where (late-early)>90 for a minute and a half, or | where (late-early)>300 for 5 minutes

from User warren – Stack Overflow https://stackoverflow.com/questions/73543582/alert-setting-in-case-of-a-large-interval-between-messages/73546893#73546893
via IFTTT

merikebi