I am searching to confirm the SPL to poll a KV Store check the status of the es_notable_events when a status changes and then send an email, also would like to check timestamps to work out what the newest event is
The SPL i have working to send (most of the time) is below
es_notable_events is lookup updated from saved search(ESS - Notable Events) for every 5 minutes. So if you use es_notable_events to send email notification on status change of notable, you need to wait 1-5 minutes to that change updated in es_notable_events. Hence you can directly use the search of saved search(ESS - Notable Events) which is what I am using here in this solution below:
Firstly, you need to write all your output of below search to lookup table where you will create new fields updated_time value would be now() , assuming we have sent an email to all for now.
time_range for below search depends on for how long you wanna keep a track of notable events. es_notable_events lookup will have only last 48 hours of events. if you think all notables status will be changed within 48 hours , you can set time range is 48 hours, I believe you might take more than 48 hours to resolve notable/incident. and this lookup will be growing in future to have track of changes for which we need to send an email