creating alert for alert

[Puvi]

hi,

i have a panel with all the alert details in it.
now i want to create a separate alert for that panel like (if alerts are triggering within 10 mins span)
can you help me in this?

[woodcock]

You can get a list of all non-expired alerts like this:

| rest/servicesNS/-/-alerts/fired_alerts/-
| table trigger_time author eai:acl.owner eai:acl.app savedsearch_name sid eai:acl.sharing digets_mode id published *
| rename eai:acl.* AS *
| where trigger_time >= relative_time(now(), "-10m@m")

[arjunpkishore5]

This should help you get started

index=_audit action="alert_fired" 
| rename ss_name AS alert_name
| sort alert_name, _time
| delta _time as timediff
| streamstats count as rownum by alert_name reset_on_change=true
| eval timediff=if(rownum==1, null(), abs(timediff))
| where timediff<600

This will give you all alerts which triggered less than 10 mins apart.

hope this helps