i have a panel with all the alert details in it.
now i want to create a separate alert for that panel like (if alerts are triggering within 10 mins span)
can you help me in this?
You can get a list of all non-expired alerts like this:
| table trigger_time author eai:acl.owner eai:acl.app savedsearch_name sid eai:acl.sharing digets_mode id published *
| rename eai:acl.* AS *
| where trigger_time >= relative_time(now(), "-10m@m")
This should help you get started
| rename ss_name AS alert_name
| sort alert_name, _time
| delta _time as timediff
| streamstats count as rownum by alert_name reset_on_change=true
| eval timediff=if(rownum==1, null(), abs(timediff))
| where timediff<600
This will give you all alerts which triggered less than 10 mins apart.
hope this helps