Alert logic not working
my log analytics search query returns computer name and count 1 when true. but the alert, using the same logic, and a threshold of greater than 0, does not fire.
Event
| where EventID == 7036
| where RenderedDescription contains "web" and RenderedDescription contains "stopped"
| summarize lastLog = max(TimeGenerated) by Computer
| where lastLog < ago(5m)
| summarize count() by Computer
1
vote
Link
shared this idea