Right now I am creating the alerts in our DEV environment and the lag is negligible, but that will definitely be something I'll keep in mind once we're promoting it to PAT and PROD. Ultimately, the goal of the alert is to catch a trend in 5-minute intervals for a specific error code. If there are occasional spikes that are not sustained (say, in the first 5 minutes the count is 6 but in the second and third the count is 1 or 0) we don't want the alert to be triggered. But I'll be running some tests with the application folks by injecting the signatures into the logs at various rates, so I'll be able to determine if I'll have to shift the time windows. Thanks again, Bowesmana. You've been very helpful and I appreciate you sharing your knowledge. ... View more

Thank you Bowesman, That makes sense and simplifies the query significantly. I added two different indexes by mistake when I added my reply, I only need to search a single index. The only thing that is still not clear to me is the values that I need to refer to in the "earliest" and "latest. So, I grabbed your query and listed the "latest" as "@m": index=cts-ep-app earliest=-15m@m latest=@m "Waiting" | bin _time span=5m aligntime=@m | stats count by _time | stats sum(eval(if(count>=3,1,0))) as AllOverThreshold | where AllOverThreshold=3   And that seems to have done the trick. Many thanks. Appreciate you taking the time to chime in. ... View more

An update to my original question: I managed to build a query that runs the 3 searches I need within the defined timeframes and validated that the results are good: index=foo earliest=-5m@m latest=now | search "Waiting" | stats count as counter1 | append [ | search "Waiting" index=its-em-pbus3-app earliest=-10m@m latest=-5m@m | stats count as counter2 ] | append [ | search "Waiting" index=its-em-pbus3-app earliest=-15m@m latest=-10m@m | stats count as counter3 ] I have displayed the results from each query in a table and compared them against searches for the same timeframes to confirm that the values matched. So that's part 1 dealt with. Now I'm trying to figure out a way to generate a result to this query that would indicate that the value of the 3 counts is >=3. I tried using "case" to check each value individually and assign a value to a "results" field using eval: | eval results = case ( counter1 >= 3 AND counter2 >=3 AND counter3>=3 , "true"   My goal was to be able to search for the "results" field value to determine if my conditions were met, but no dice. ... View more