Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Alerting
- :
- How to configure my two alerts so if the first ale...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
I have two alerts. How do I configure them so if the first alert is triggered, the second alert should not be sent?
thank you
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Using this search, you can check if an alert was fired from a saved search or not
index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" NOT (alert_actions="summary_index" OR alert_actions="") savedsearch_name="PROVIDE YOUR SEARCH NAME HERE" | stats count | eval search=if(count>0,"1=2","1=1") | return $search
Use this a subsearch in the base search of 2nd alert
your base search [search index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" NOT (alert_actions="summary_index" OR alert_actions="") savedsearch_name="PROVIDE YOUR SEARCH NAME HERE" | stats count | eval search=if(count>0,"1=2","1=1") | return $search] | rest of search
I'm assuming that your 2nd alert checks the no of rows from the result and fires when there are events returned. With this subsearch, if first alert is fired, a condition 1=2 (always false) will be returned and 2nd alert will not yield any result.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Using this search, you can check if an alert was fired from a saved search or not
index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" NOT (alert_actions="summary_index" OR alert_actions="") savedsearch_name="PROVIDE YOUR SEARCH NAME HERE" | stats count | eval search=if(count>0,"1=2","1=1") | return $search
Use this a subsearch in the base search of 2nd alert
your base search [search index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" NOT (alert_actions="summary_index" OR alert_actions="") savedsearch_name="PROVIDE YOUR SEARCH NAME HERE" | stats count | eval search=if(count>0,"1=2","1=1") | return $search] | rest of search
I'm assuming that your 2nd alert checks the no of rows from the result and fires when there are events returned. With this subsearch, if first alert is fired, a condition 1=2 (always false) will be returned and 2nd alert will not yield any result.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes! it's work!
Splunk Observability for AI
Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...
Splunk Observability as Code: From Zero to Dashboard
