How to trigger alert when the index from Down to Running State?

[karthi2809]

How to trigger alert when the index from Down to Running State?
My query is to find index is down.But it will trigger only once.I need to continuously when the index is to running state .

| metadata type=hosts index*_prod | eval age = now() - recentTime | eval status= case(age < 900,"Running",age > 900,"DOWN") | convert ctime(recentTime) AS LastActiveOn
| eval age=tostring(age,"duration") | eval host = upper(host)
| table host age LastActiveOn status
| rename host as "Forwarder Name", age as "Last Heartbeat(min)",LastActiveOn as "Last Active On",status as Status|where Status= "DOWN"

[pkeenan87]

Have you looked at the meta woot app? https://splunkbase.splunk.com/app/2949/ This is very helpful in auditing when data sources/indexes are down. There are some panels you could use as a template to convert into an alert