I seem to be having some issues with understanding the correlation time in LEM's rule creation. I have a rule set up to monitor when a certain event is logged in Windows application monitor. You can see its set to trigger if 5 of those events occur within 60 seconds.
However I seem to be getting an email alert whenever that event is seen even though I only need it to trigger when the event appears 5 times in the span of 60 seconds? Is this not the correct setup for something like this?