Splunk Search

How to create a trigger alert with condition that relies on an other alert?

mcayrol
Explorer

Hello splunkers,

I don't now if my title makes sense but here is the situation :

I have an alert called buy signal and another called sell signal.

I want to make sure that only my buy signal alert can be triggered ONCE and after i want to make sure only my sell signal alert can be triggered ONCE etc etc ..

Do you now a parameter that can do this ?

Thank you for your help

Labels (2)
0 Karma

mcayrol
Explorer

Don't hesitate if you need more information

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

Currently splunk don't support this kind of chained alerting. There is request for that in ideas.splunk.com.

Anyway you could try to create alert which write event to the new index (Add Actions -> Add to Triggered Alerts), then create second alert which is using that output from index etc....

r. Ismo

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!