I had the same problem a few days ago, basically I think “macros.past_5m” shouldn’t be in quotes, for some reason the GUI adds it.
When creating the alert, I just chose Import from old syntax, and put in the query like this,
syslog.timestamp >= macros.past_5m AND syslog.msg REGEXP ".segfault."
My query does have a timestamp with the output of %value.string but no way to pull it out separately that i can find. Perhaps this is configurable on either syslog or the box itself. The only other way i can find is just the alert timestamp of %timestamp