@James Henrich Though i am not clear on what exactly you are looking for, i can explain the time related conditions in alerts
we run the alert query every 30secs. the query results across two subsequent runs are compared to decide if alert is to be triggered or resolved
in the alert conditions section you will notice in last <5 | 15 | 60 > minutes option. this timeframe is applied when picking data from clickhouse for evaluation. so if you set 5 mins, the count of metrics in last 5 mins will be picked. but the results will be put into 30 secs bucket (step size).
now there is another option in alert conditions called in total. if you choose this then all the steps will get added up returning you total count in last 5 mins
if you want something specific you can also write a clickhouse query directly.