To save an Alarm Rule from a query:

  1. Open a dashboard.
  2. In the search bar, enter your search criteria and (optionally) a time interval in the time filter. For more information about how to query data, see Search Your Data.
  3. Click Save Rule.
    The Create Rule dialog box appears.
  4. Enter a Name and choose a Severity. You can also change the Search string, if desired.
  5. Click Save.
    You are notified of how many times your new rule would have fired in the past 24 hours.
  6. To create the rule, click Confirm. Otherwise, click Cancel.