How to configure my two alerts so if the first alert is triggered, the second one will not be sent?

[gibba]

Hi

I have two alerts. How do I configure them so if the first alert is triggered, the second alert should not be sent?

thank you

[somesoni2 · Accepted solution]

Using this search, you can check if an alert was fired from a saved search or not

index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" NOT (alert_actions="summary_index" OR alert_actions="") savedsearch_name="PROVIDE YOUR SEARCH NAME HERE" | stats count | eval search=if(count>0,"1=2","1=1") | return $search

Use this a subsearch in the base search of 2nd alert

your base search [search  index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" NOT (alert_actions="summary_index" OR alert_actions="") savedsearch_name="PROVIDE YOUR SEARCH NAME HERE" | stats count | eval search=if(count>0,"1=2","1=1") | return $search] | rest of search

I'm assuming that your 2nd alert checks the no of rows from the result and fires when there are events returned. With this subsearch, if first alert is fired, a condition 1=2 (always false) will be returned and 2nd alert will not yield any result.

[gibba]

Yes! it's work!