I set up an alert, looks for the last 15 min data for every 15 min.
I have a list of hosts in the lookup table, when the hosts in the lookup table is not reporting sends and an email alert. When indexing is stopped, or indexers are stopped, or indexing latency is more than 15min I am receiving alert for every host.
I want to stop receiving alerts when environmental issue occurred
|inputlooup host.csv | join host type=left [search index=* [|inputlooup host.csv]| stats count by host ] | fillnull value=0 | where count=0
I have a query something like this
