I want to get an alert when there is switch between events for the first time. Below is the example for this.
index=abc sourcetype=xyz <warning>
index=abc sourcetype=xyz <critical>
These 2 queries I have and I want an alert when there is switch between from <warning> to <critical>.
Please help with the query.
You should look at using streamstats - here's an example that creates 10 events where every 4th event changes from warning to critical.
| makeresults count=10
| streamstats c
| eval _time=now() - c
| eval type=if(c % 4 = 0, "critical", "warning")
| fields - c
| sort - _time
| streamstats count reset_after="("type=\"warning\"")" by type
| where count=1 AND type="critical"
To give you an exact solution would need to know more about your requirement.
This will give 2 results when the type changes to critical from warning