Splunk Search

How to create a trigger alert with condition that relies on an other alert?

mcayrol
Explorer

Hello splunkers,

I don't now if my title makes sense but here is the situation :

I have an alert called buy signal and another called sell signal.

I want to make sure that only my buy signal alert can be triggered ONCE and after i want to make sure only my sell signal alert can be triggered ONCE etc etc ..

Do you now a parameter that can do this ?

Thank you for your help

Labels (2)
0 Karma

mcayrol
Explorer

Don't hesitate if you need more information

0 Karma

soutamo
SplunkTrust
SplunkTrust

Hi

Currently splunk don't support this kind of chained alerting. There is request for that in ideas.splunk.com.

Anyway you could try to create alert which write event to the new index (Add Actions -> Add to Triggered Alerts), then create second alert which is using that output from index etc....

r. Ismo

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.