Hello, i'm making alerts for a client, we need 2 alerts, one of them was very easy to make:
Running on cron schedule every 5 minutes, alert if mybasesearch: "index=myindex errorcode=0" returns more than 20 results. The problem is with the second one, they want Splunk to alert when there are no more errorcode=0's on the search.
So what I have in mind is to make a query which compares T1=(-5 to -10 mins ago) and T2=(now() to -5 mins ago) and eval
IF isnull(T1) and isnull(T2) => do nothing
IF isnotnull(T1) and isnotnull(T2) => do nothing
IF isnull(T1) and isnotnull(T1) => do nothing, becase we have alert 1 for this
IF isnotnull(T1) and isnull(T2) => ALERT EVERYTHING IS OK AGAIN!
can you help me to translate this logic to SPL? Im thinking about relative time but I don't know how to do it. the best BEST would be to put everything in just 1 alert, but 2 alerts are fine too,
Thanks!
