Alerting

How to configure my two alerts so if the first alert is triggered, the second one will not be sent?

gibba
Path Finder

Hi

I have two alerts. How do I configure them so if the first alert is triggered, the second alert should not be sent?

thank you

1 Solution

somesoni2
Revered Legend

Using this search, you can check if an alert was fired from a saved search or not

index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" NOT (alert_actions="summary_index" OR alert_actions="") savedsearch_name="PROVIDE YOUR SEARCH NAME HERE" | stats count | eval search=if(count>0,"1=2","1=1") | return $search

Use this a subsearch in the base search of 2nd alert

your base search [search  index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" NOT (alert_actions="summary_index" OR alert_actions="") savedsearch_name="PROVIDE YOUR SEARCH NAME HERE" | stats count | eval search=if(count>0,"1=2","1=1") | return $search] | rest of search

I'm assuming that your 2nd alert checks the no of rows from the result and fires when there are events returned. With this subsearch, if first alert is fired, a condition 1=2 (always false) will be returned and 2nd alert will not yield any result.

View solution in original post

somesoni2
Revered Legend

Using this search, you can check if an alert was fired from a saved search or not

index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" NOT (alert_actions="summary_index" OR alert_actions="") savedsearch_name="PROVIDE YOUR SEARCH NAME HERE" | stats count | eval search=if(count>0,"1=2","1=1") | return $search

Use this a subsearch in the base search of 2nd alert

your base search [search  index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" NOT (alert_actions="summary_index" OR alert_actions="") savedsearch_name="PROVIDE YOUR SEARCH NAME HERE" | stats count | eval search=if(count>0,"1=2","1=1") | return $search] | rest of search

I'm assuming that your 2nd alert checks the no of rows from the result and fires when there are events returned. With this subsearch, if first alert is fired, a condition 1=2 (always false) will be returned and 2nd alert will not yield any result.

View solution in original post

gibba
Path Finder

Yes! it's work!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!