we have multiple site, site is n number, if any site fires 9251 that particular site should not be in the list as that site is in network Maintenace mode.any site can fires multiple alerts 9047 OR/AND 9251
now
9047 is fired from a b c d e
9251 is fired from c d
c d fired 9251 as this site or device is under maintenance
so
A 9047
B 9047
C 9251 9047
D 9251 9047
E 9047
so my output contain only
A 9047
B 9047
E 9047
how to write Splunk Queary for the same @
