Currently alerting snapshot (the image sent by mail) uses the dashboard time (eg. 12 hours ago) or time overrides from _Time range_ graph setting.
It would be useful to have a _Time range override_ per alert rule, so for example in dashboard the graph is displayed for last 12h, but when receiving an alert email the graph is displayed for the last 2h.
I think both options makes sense. Queries with some aggregations might not show as alerting in the 24h window but in last 2h. I dont think its a good idea to send an image not breaking the threshold.
Perhaps we should send two images?
I think one image suffice. What I'm saying is that it would be useful to have a _Time range override_ per alert, which should be taken into account when sending the graph snapshot and computing the thresholds.
This way I can have a zoomed in version in my email, and also for queries doing aggregation (which might be time range sensible) a more stable time range. - All these optional, if I decide I need it.
Now that the snapshots are 2h back (the difference between my server set to UTC and my local time), it would also be nice to see an option for specifying the TZ (timezone) for the email alert snapshot.
Most helpful comment
Now that the snapshots are 2h back (the difference between my server set to UTC and my local time), it would also be nice to see an option for specifying the TZ (timezone) for the email alert snapshot.