How to create a trigger alert with condition that relies on an other alert?

[mcayrol]

Hello splunkers,

I don't now if my title makes sense but here is the situation :

I have an alert called buy signal and another called sell signal.

I want to make sure that only my buy signal alert can be triggered ONCE and after i want to make sure only my sell signal alert can be triggered ONCE etc etc ..

Do you now a parameter that can do this ?

Thank you for your help

[mcayrol]

Don't hesitate if you need more information

[isoutamo]

Hi

Currently splunk don't support this kind of chained alerting. There is request for that in ideas.splunk.com.

Anyway you could try to create alert which write event to the new index (Add Actions -> Add to Triggered Alerts), then create second alert which is using that output from index etc....

r. Ismo