mail alert not functioning properly

ayushmaan_22 — Tue, 09 Jun 2020 16:23:05 GMT

Hi all,

I made an alert which sends out mail to the respective teams whenever a high priority task has not been updated for more than an hour. The query is as follows:-

index="abc" INC* main_metric,

state="New" OR state="In Progress" OR state="Awaiting Third Party" OR state="Pending" priority = "1 - Critical" OR priority = "2 - High"

| rex field=_raw "main_metric=\"(?<main_metric>\S+\s\d+\:\d+\:\d+)\""

| dedup main_metric

| dedup number

| eval main_metric = upper(main_metric) 

| lookup lookup_inactivity_alert_distribution_list.csv assignment_group OUTPUT "Email_To" "Email_Cc" "Email_Bcc" "Enabled" 

| fillnull value=0

| search number != 0 AND Enabled = "Y" AND main_metric != 0

| eval end=strptime(main_metric, "%Y-%m-%d %H:%M:%S.%N")

| eval start=now()

| eval diff = start - end  

| lookup lookup_frequency_impact.csv impact output "Frequency1" "Frequency2" "Frequency3" "Frequency4" 

| eval freqdiff1 = Frequency1 + 600

| eval freqdiff2 = Frequency2 + 600

| eval freqdiff3 = Frequency3 + 600

| eval freqdiff4 = Frequency4 + 600

|eval result = case('caller_id' = "SCOM System" AND

'diff' >= 'Frequency3' AND  

'diff' <= 'freqdiff3',"outcome1",'caller_id' != "SCOM System" AND 'diff' >= 'Frequency1' AND

'diff' <= 'freqdiff1',"ouitcome2",'caller_id' != "SCOM System" AND 'diff' >= 'Frequency2' AND

'diff' <= 'freqdiff2',"outcome3",'caller_id' != "SCOM System" AND 'diff' >= 'Frequency3' AND

'diff' <= 'freqdiff3',"outcome4",'caller_id' != "SCOM System" AND 'diff' >= 'Frequency4' AND

'diff' <= 'freqdiff4',"outcome5",1==1,"no outcome")

| search result="outcome1" OR result="outcome2" OR result="outcome3" OR result="outcome4" OR result="outcome5" AND state!="Closed"

| table  main_metric priority caller_id result assignment_group u_updated_on "Email_To" Email_Cc Email_Bcc number start end diff Frequency1 Frequency2 Frequency3 Frequency4

| map alert_main_metric_mail assignment_group="$assignment_group$" to="$Email_To$" cc="$Email_cc$" bcc="$Email_Bcc$"

The second lookup handles the frequency with which the alert emails are to be sent with respect to the priority of the ticket. Now the problem that I am having is that if the ticket or task is closed within half an hour of it being created, the alert is still generated. Even if the ticket is de-escalated, the alert is still being received. I tried many modifications in the code but nothing seems to work. Could you all help me with this bug?

P.S.: The map commands connect just the saved search which sends out the emails with the appropriate subject and description.

topic mail alert not functioning properly in Alerting

mail alert not functioning properly