Forum Discussion
Solved
Alert delay
I am experimenting with creating alerts using the new query language against data uploaded through the data collector API. I am consistently seeing a 10 minute delay between when an alert query is r...
- This seems to be a bug. I've notified the responsible team for this and hopefully they will get it fixed.
I run into this problem periodically (there are a variety of factors that can delay the data sources). Here's a query to check the latest in Hearbeat, but if you replace the DataSource with another, it'll tell you when it last saw information from that source. I alert based off of the value put out by the Latency value in the query.
Heartbeat
| summarize LatestHeartbeat=max(TimeGenerated)
| extend Latency=now()-LatestHeartbeat
I hope that helps!