indexing triage

[nagarjuna280]

how can I skip alerts when indexing is stopped or indexers are stopped or indexing latency is more than 15min

[ssadanala1]

what is the use case and can you elaborate?

[nagarjuna280]

I set up an alert, looks for the last 15 min data for every 15 min.
I have a list of hosts in the lookup table, when the hosts in the lookup table is not reporting sends and an email alert. When indexing is stopped, or indexers are stopped, or indexing latency is more than 15min I am receiving alert for every host.
I want to stop receiving alerts when environmental issue occurred
|inputlooup host.csv | join host type=left [search index=* [|inputlooup host.csv]| stats count by host ] | fillnull value=0 | where count=0
I have a query something like this