Why doesn't Dynatrace alert properly?

[GerryIsHere]

Why doesn't this work? What we want is incredibly simple, yet our Dynatrace team (I don't have admin access) can't get it straight. 

If a DQL returns 0 logs for a 15 minute period, send an alert. Doesn't seem to asking too much, yet after only a few minutes of no activity an alert was sent. There were 16 alert emails last night - not one of them legitimate. 

--------------------------------------------------------------------------------------------------------------------

This is a different one. The purple line drops below the threshold only briefly a couple times. What is this red line telling us? This one also alerted when it should not have.

[dannemca]

If I understood correctly, you are creating a metric event from a log metric extraction, and in that case, if no logs are present, the count will not show you 0, but nothing. So in order to generate an alert for that case, you will need to enable the "Alert on missing data".

----

For the second case, the doted red line is the threshold, and the red bar above is the alert happening. Probably it did generated because you have set the alert to trigger if value is below threshold at least once in that interval. Hard to say for sure without seeing the full picture. You should see the interval expanding the "Advanced model properties" section.