Can you suggest what should be search query of an alert that would trigger an alert only if a particular event say 'a' occurs twice. But for rest of the events it triggers and alert even if there is one single event.
Count the number of times events occur by whatever field contains what you are looking for with the stats command, then filter on whether the count is 2 (or greater?) and use this as the base for your alert.
Thank you @ITWhisperer but this will trigger alert for all types event. But I want if "*null_error*" is logged twice or more than twice in logs then only it triggers the alert. For rest of the events alert should get triggered even if there is a single event of it. Is this possible in single alert?
