Help me creating correct alert condition

[ushiii111798 (BrianHong)]

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

1. Describe your incident:
I have my stream collect log for login
I want to create slack alert if any login attempt found with in last 1 min, every 1 min
(In other word, every one minute, I want to get notification if any login has attempted for the last one minute)

2. Describe your environment:

• OS Information: ubuntu 20.04

• Package Version: latest

• Service logs, configurations, and environment variables:

3. How can the community help?
I setup like this

and this is not working as I wanted.

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

[gsmith]

Hello @ushiii111798

I have done this already. In your screenshot click “Aggregation of results reaches a threshold”

And have the setting like so…

Now if yo want, you can adjust Notification setting to have a grace period, with the amount of back logs you wish.

Should be good,

What I showed was if any message hits your stream (i.e., API_BDSCC) , GREATER Then 0, alert. Notification settings states wait 1 second before alerting again.

hope that helps