It worked, I had a Index problem. Thanks for your response. ... View more

Keep track of your alert state in a lookup table; you need 2 searches like these: Set Alert (fire once): index=someindex sourcetype="somesourcetype" source="somesource" VAR1="StaticValue" VAR2="StaticValue" | dedup VAR1 VAR2 | where NUMERICAL_VALUE > 5 | table VAR1 VAR2 NUMERICAL_VALUE | lookup YourLookupFileNameHere.csv VAR1 VAR2 OUTPUT fired_time | where isnull(fired_time) | eval fired_time=now() | outputlookup coverride_if_empty=false YourLookupFileNameHere.csv Then create another scheduled search to clear out the lookup file when NUMERICAL_VALUE < 5. ... View more

somesoni2 you are the man, that worked like a dream thank you for the example, that really simplified things. ... View more

cute. I hadn't thought of using addinfo instead of pulling it off the interface. ... View more