Enhancement case #464044
Requesting that Splunk have an option to send an all clear alert after x many iterations of an alert condition not matching after having matched for 1 or more iterations.
Example: An alert is triggered for CPU usage above 95% which may send an email, a notice in Triggered Alerts, run a script, and/or a post to slack.
I would like to have a check box option to send another alert when the condition has cleared. i..e CPU has dropped below 95%
Ideally this would be a checkbox with an option for how many negative matches before an all clear alert is sent.
If I check cpu average every 5 minutes and get these values:
check01 5:05 PM CPU 95%
check02 5:10 PM CPU 95%
check03 5:15 PM CPU 75%
check04 5:20 PM CPU 75%
check01 would trigger the initial alert
check03 would trigger the all clear
Enhancement case #464044 opened.
