Alerting

How to configure my two alerts so if the first alert is triggered, the second one will not be sent?

gibba
Path Finder

Hi

I have two alerts. How do I configure them so if the first alert is triggered, the second alert should not be sent?

thank you

1 Solution

somesoni2
Revered Legend

Using this search, you can check if an alert was fired from a saved search or not

index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" NOT (alert_actions="summary_index" OR alert_actions="") savedsearch_name="PROVIDE YOUR SEARCH NAME HERE" | stats count | eval search=if(count>0,"1=2","1=1") | return $search

Use this a subsearch in the base search of 2nd alert

your base search [search  index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" NOT (alert_actions="summary_index" OR alert_actions="") savedsearch_name="PROVIDE YOUR SEARCH NAME HERE" | stats count | eval search=if(count>0,"1=2","1=1") | return $search] | rest of search

I'm assuming that your 2nd alert checks the no of rows from the result and fires when there are events returned. With this subsearch, if first alert is fired, a condition 1=2 (always false) will be returned and 2nd alert will not yield any result.

View solution in original post

somesoni2
Revered Legend

Using this search, you can check if an alert was fired from a saved search or not

index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" NOT (alert_actions="summary_index" OR alert_actions="") savedsearch_name="PROVIDE YOUR SEARCH NAME HERE" | stats count | eval search=if(count>0,"1=2","1=1") | return $search

Use this a subsearch in the base search of 2nd alert

your base search [search  index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" NOT (alert_actions="summary_index" OR alert_actions="") savedsearch_name="PROVIDE YOUR SEARCH NAME HERE" | stats count | eval search=if(count>0,"1=2","1=1") | return $search] | rest of search

I'm assuming that your 2nd alert checks the no of rows from the result and fires when there are events returned. With this subsearch, if first alert is fired, a condition 1=2 (always false) will be returned and 2nd alert will not yield any result.

gibba
Path Finder

Yes! it's work!

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...