I don’t remember if I’ve tried in the past to use an error state only alert. The error state doesn’t happen very often, seems like it only occurs when we have an issue resolving a DNS name. I could try that. Seems odd that the rest of the states work on the existing alerts though.
The difference between the all and any is that I’ve got a bunch of threads on the same alert and I want to track if any of them get into the error state for more than 15 minutes.