Ingestion Lag

| where ingestionTime > 5m
 
 Setting: 
 
 Run query every 5m 
 Lookup data from the last 24 hours 
 Stop running query after alert disabled