Skip to content

Commit d04b351

Browse files
authored
Update create-nrt-rules.md
1 parent 11d394e commit d04b351

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

articles/sentinel/create-nrt-rules.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ You create NRT rules the same way you create regular [scheduled-query analytics
5555

5656
- **Query scheduling** is not configurable, since queries are automatically scheduled to run once per minute with a one-minute lookback period.
5757
- **Alert threshold** is irrelevant, since an alert is always generated.
58-
- **Event grouping** configuration is not available, since events are always grouped into the alert created by the rule that captures the events. NRT rules cannot produce an alert for each event.
58+
- **Event grouping** configuration is now available to a limited degree. You can choose to have an NRT rule generate an alert for each event for up to 30 events. If you choose this option and the rule results in more than 30 events, single-event alerts will be generated for the first 29 events, and a 30th alert will summarize all the events in the result set.
5959

6060
In addition, the query itself has the following requirements:
6161

0 commit comments

Comments
 (0)