https://community.splunk.com/t5/Getting-Data-In/indexing-triage/m-p/393427#M70249 <P>how can I skip alerts when indexing is stopped or indexers are stopped or indexing latency is more than 15min</P> Mon, 06 Aug 2018 20:16:25 GMT nagarjuna280 2018-08-06T20:16:25Z https://community.splunk.com/t5/Getting-Data-In/indexing-triage/m-p/393427#M70249 <P>how can I skip alerts when indexing is stopped or indexers are stopped or indexing latency is more than 15min</P> Mon, 06 Aug 2018 20:16:25 GMT https://community.splunk.com/t5/Getting-Data-In/indexing-triage/m-p/393427#M70249 nagarjuna280 2018-08-06T20:16:25Z https://community.splunk.com/t5/Getting-Data-In/indexing-triage/m-p/393428#M70250 <P>what is the use case and can you elaborate?</P> Mon, 06 Aug 2018 20:37:27 GMT https://community.splunk.com/t5/Getting-Data-In/indexing-triage/m-p/393428#M70250 ssadanala1 2018-08-06T20:37:27Z https://community.splunk.com/t5/Getting-Data-In/indexing-triage/m-p/393429#M70251 <P>I set up an alert, looks for the last 15 min data for every 15 min.<BR /> I have a list of hosts in the lookup table, when the hosts in the lookup table is not reporting sends and an email alert. When indexing is stopped, or indexers are stopped, or indexing latency is more than 15min I am receiving alert for every host.<BR /> I want to stop receiving alerts when environmental issue occurred <BR /> |inputlooup host.csv | join host type=left [search index=* [|inputlooup host.csv]| stats count by host ] | fillnull value=0 | where count=0<BR /> I have a query something like this </P> Mon, 06 Aug 2018 22:44:43 GMT https://community.splunk.com/t5/Getting-Data-In/indexing-triage/m-p/393429#M70251 nagarjuna280 2018-08-06T22:44:43Z