which finds errors that I care about. Now, suppose I want to send these errors, on certain conditions, so I want to use the alert_condition feature of savedsearches.conf. Let's say the condition I want to use is that it is not working hours -- totally unrelated to the original search. However, alert_condition is fed the event stream from the original search.
How can I efficiently dump the original stream, when needed?
The best I can come up with is
alert_condition = head 1 | where 1=2 | append [search ....]