Alerting

Is it possible to close an alert based on an other search/alert?

aatik5u
Path Finder

Hello there,

To keep it simple, I am trying to figure out how to make an alert depend on other alert. Imagine triggering an alert because there is "fail" in some event, but if in the same day there is "success" in the same source, the first alert would be closed and the "success" will be alerted instead.

Am I making any sense? can anyone help?

If it matters I am using Alert manager add-on

Cheers, 

Labels (2)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...