https://community.splunk.com/t5/Alerting/Cancel-Alert-with-Different-Alert/m-p/404746#M7119 <P>I am looking to create a dashboard panel that is synced with our AV tool. The tool that we use is sending events to splunk when the AV protection is disabled and re-enabled. I dont know how to display only the devices that have not had AV re-enabled.</P> <P>i.e.</P> <P>PC 1000 is disabled<BR /> PC 1000 is enabled<BR /> PC 2003 is disabled</P> <P>The dashboard panel would show one device that needs enabled. Until an event related to PC 2003 is sent that show "PC 2003 is enabled" then the dashboard will show one device needing attention.</P> <P>How do set "disabled" as + "1" and enabled as - "1"? Unless there is a better way..</P> <P>Thanks!</P> Tue, 23 Jul 2019 18:09:42 GMT Becherer 2019-07-23T18:09:42Z https://community.splunk.com/t5/Alerting/Cancel-Alert-with-Different-Alert/m-p/404746#M7119 <P>I am looking to create a dashboard panel that is synced with our AV tool. The tool that we use is sending events to splunk when the AV protection is disabled and re-enabled. I dont know how to display only the devices that have not had AV re-enabled.</P> <P>i.e.</P> <P>PC 1000 is disabled<BR /> PC 1000 is enabled<BR /> PC 2003 is disabled</P> <P>The dashboard panel would show one device that needs enabled. Until an event related to PC 2003 is sent that show "PC 2003 is enabled" then the dashboard will show one device needing attention.</P> <P>How do set "disabled" as + "1" and enabled as - "1"? Unless there is a better way..</P> <P>Thanks!</P> Tue, 23 Jul 2019 18:09:42 GMT https://community.splunk.com/t5/Alerting/Cancel-Alert-with-Different-Alert/m-p/404746#M7119 Becherer 2019-07-23T18:09:42Z https://community.splunk.com/t5/Alerting/Cancel-Alert-with-Different-Alert/m-p/404747#M7120 <P>Assuming each event has a 'server' field ("PC 1000", for example) and a 'status' field ("disabled" or "enabled") then one just needs to look at the most recent status for each server and ignore those that are enabled. Something like this will show the devices needing attention:</P> <PRE><CODE>index = foo | stats latest(status) as status by server | where status = "disabled" </CODE></PRE> Tue, 23 Jul 2019 18:30:44 GMT https://community.splunk.com/t5/Alerting/Cancel-Alert-with-Different-Alert/m-p/404747#M7120 richgalloway 2019-07-23T18:30:44Z