How to set up a Splunk Alert if the field value is changed?

[ud2110]

Hi 

Need help on the below:

I have 2 field values for Status as RUNNING and SUCCESS. I want to generate 1st alert when the status becomes RUNNING for current day and the 2nd alert when the status get changed to SUCESS. 

I don't want  duplicate alerts till the time status is not getting changed

Thanks

[isoutamo]

Hi
Have you try to use input-/outputlookup to keep track if you have found those already on current day?
r. Ismo