Forum Discussion
[DETECTION] 'Frequency', 'Period', and 'Suppression' precision
Molx32 The Period is used just like its description states, it is the time period for your data. If you look under the "Set alert query" heading above where you enter your query it does state "Set time and interview parameters only using the Period field under Alert scheduling."
So it appears that MS does not want any sort of time parameter in the query itself. Hopefully someone from MS can state why that is.
Its related to https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-unified-log
"The query returns only records that were created within this range of the current time. Time period restricts the data fetched for log query to prevent abuse and circumvents any time command (like ago) used in log query. " 24hrs is the max.