topic creating alert for alert in Alerting

creating alert for alert

Puvi — Mon, 25 Nov 2019 05:36:53 GMT

hi,

i have a panel with all the alert details in it.
now i want to create a separate alert for that panel like (if alerts are triggering within 10 mins span)
can you help me in this?

Re: creating alert for alert

arjunpkishore5 — Mon, 25 Nov 2019 13:02:16 GMT

This should help you get started

index=_audit action="alert_fired" 
| rename ss_name AS alert_name
| sort alert_name, _time
| delta _time as timediff
| streamstats count as rownum by alert_name reset_on_change=true
| eval timediff=if(rownum==1, null(), abs(timediff))
| where timediff<600

This will give you all alerts which triggered less than 10 mins apart.

hope this helps

Re: creating alert for alert

woodcock — Fri, 29 Nov 2019 20:06:33 GMT

You can get a list of all non-expired alerts like this:

| rest/servicesNS/-/-alerts/fired_alerts/-
| table trigger_time author eai:acl.owner eai:acl.app savedsearch_name sid eai:acl.sharing digets_mode id published *
| rename eai:acl.* AS *
| where trigger_time >= relative_time(now(), "-10m@m")