Alerting

How to configure my two alerts so if the first alert is triggered, the second one will not be sent?

gibba
Path Finder

Hi

I have two alerts. How do I configure them so if the first alert is triggered, the second alert should not be sent?

thank you

1 Solution

somesoni2
Revered Legend

Using this search, you can check if an alert was fired from a saved search or not

index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" NOT (alert_actions="summary_index" OR alert_actions="") savedsearch_name="PROVIDE YOUR SEARCH NAME HERE" | stats count | eval search=if(count>0,"1=2","1=1") | return $search

Use this a subsearch in the base search of 2nd alert

your base search [search  index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" NOT (alert_actions="summary_index" OR alert_actions="") savedsearch_name="PROVIDE YOUR SEARCH NAME HERE" | stats count | eval search=if(count>0,"1=2","1=1") | return $search] | rest of search

I'm assuming that your 2nd alert checks the no of rows from the result and fires when there are events returned. With this subsearch, if first alert is fired, a condition 1=2 (always false) will be returned and 2nd alert will not yield any result.

View solution in original post

somesoni2
Revered Legend

Using this search, you can check if an alert was fired from a saved search or not

index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" NOT (alert_actions="summary_index" OR alert_actions="") savedsearch_name="PROVIDE YOUR SEARCH NAME HERE" | stats count | eval search=if(count>0,"1=2","1=1") | return $search

Use this a subsearch in the base search of 2nd alert

your base search [search  index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" NOT (alert_actions="summary_index" OR alert_actions="") savedsearch_name="PROVIDE YOUR SEARCH NAME HERE" | stats count | eval search=if(count>0,"1=2","1=1") | return $search] | rest of search

I'm assuming that your 2nd alert checks the no of rows from the result and fires when there are events returned. With this subsearch, if first alert is fired, a condition 1=2 (always false) will be returned and 2nd alert will not yield any result.

gibba
Path Finder

Yes! it's work!

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...