Conditional Alerting

[mookiie2005]

I am trying to indicate that a problem has been resolved or is no longer an issue. What I want to do is have an alert that searches to see if a specific alert has triggered in the last 10 minutes. If it HAS then I want to do a secondary search to look for all alerts that begin with the prefix "PLCY_SVCS_bindqtesvc" I want the alert to fire an e-mail if 1 or less alerts with the prefix PLCY_SVCS_bindqtesvc" have been fired. I have been using the below search, but I cannot get it to function in the manner I need. Please help:

index=_audit action=alert_fired ss_app=* ss_name=* triggered_alerts=1 [search index=_audit action=alert_fired ss_app=* ss_name=PLCY_SVCS_bindqtesvc_RED_status_Sean_TEST triggered_alerts=1 | stats count AS count ss_name app_log | where count > 0 | table app_log] earliest=-10m@m | stats count | where count < 2

[somesoni2]

Try this

index=_audit action=alert_fired ss_app=* ss_name=PLCY_SVCS_bindqtesvc_RED_status_Sean_TEST triggered_alerts=1 | stats count | where count > 0 
| map maxsearches=1 search="search index=_audit action=alert_fired ss_app=* ss_name=PLCY_SVCS_bindqtesvc* triggered_alerts=1 | stats count | where count <2"

Here, first the count of events with ss_name=PLCY_SVCS_bindqtesvc_RED_status_Sean_TEST is calculated. If count > 0 then next search will get executed to get the count of alerts for ss_name with prefix PLCY_SVCS_bindqtesvc. You can set alert to get trigged if there are any rows retured by the search (it will return one rows with column as count if all conditions are true)