Hi, I have 14 alerts that cover all the infrastructure, my company uses. I get my data from a data bus every 60 minutes, but when that fails and it can for (several hours at a time). I would like to not have to rerun the alerts manually. As a note I don't any elevated access to the Splunk instance or the environment so I can't install apps, add-ins, or update any conf files, but I do have access to the audit and internal indexes.
Ideally I'd like my conditional trigger to be something like this:
index=_internal sourcetype=scheduler status=!success savedsearch_name="Stuff to search"
| table _time search_type status user app savedsearch_name result_count
|where result_count=0 then <search/commands to rerun alert every hour until results are in>
