Generate a alert when the Status field change from faliures to success..So we want the first success responsecode

[raghunandan1]

Generate a alert when the Status field change from faliures to success..So we want the first success responsecode after failure

[ITWhisperer]

This is remarkably similar to this question https://community.splunk.com/t5/Alerting/Generate-a-alert-when-the-status-field-change-from-500-to-2...