We have the below query, which checks whenever a server is down. So we want this query to send an alert when the status changes from Stopped to Running. Now it only sends an alert when the status is Stopped.   index="init_butcher" sourcetype="services_status.out.log" host=* | chart useother=f values(status) as services over host by service limit=0 | eval status=if('abc'="STOPPED", "DOWN", "Critical") | where 'cfd'="STOPPED" OR 'hij'="STOPPED" OR ''="STOPPED" OR 'jkl'="STOPPED" OR 'mno'="STOPPED" OR 'pqr'="STOPPED" OR 'stu'="STOPPED" OR 'vux'="STOPPED" OR 'yz'="STOPPED" | fields butcher, host, status | mvcombine host delim="," | eval message="Butcher Services are at status: ".status." Host(s):".mvjoin(host,",") ... View more