Is there an easy way to implement a recovery alert in the same query as the alert query?
For example if I have a system that creates a log file every 10 min if everything is working. I built a query that runs every half an hour and tells me if there is something new in the log location. That part is easy enough but I would also like the same query to be able to send a recovery notification.
Or is this not going to be possible because I want to trigger two different actions because from what I can tell you can only configure the one email or slack action per alert?
I did see that there is a splunk addon with VictorOps that has this functionality but I wanted to check here first before I went down that route.
