I've created an alert using the below expression. However, we're investigating ways to prevent the initial alert from firing when intentionally terminating an node or when autoscaling brings up a new node to replace the problem node.
mcount(5m, ts(my.metric)) = 0 and mcount(1h, ts(my.metric)) !=0