One alert but two different timings based on the output of the first alert

[prettysunshinez]

Hi,

I need your help in knowing if it is possible to have an alert that triggers at 1 PM everyday and if the search result is zero,the same alert should be triggered at 4PM.But if the search result is not zero,then the alert at 4PM shouldnt run.

Thanks in advance 

[s2_splunk · Accepted solution]

An alert triggers based on the conditions in an alerting search. You could create two distinct searches, where the 1pm stores a flag (1pmResults=true/false) in a lookup file and utilize that lookup file to determine whether the 4pm search is meeting alert conditions. The 4pm search will still run, but doesn't necessarily have to alert.