I want to get an alert when there is switch between events for the first time. Below is the example for this.
index=abc sourcetype=xyz <warning>
index=abc sourcetype=xyz <critical>
These 2 queries I have and I want an alert when there is switch between from <warning> to <critical>. Please help with the query.
... View more