I have 2 searches that are working but I would like to do the following. If search 1 generates a result, I would like to run search 2 and if the search count value of search 2 is over a 20, send an alert. Does anyone know if this is possible ?
search 1
| eval queue_length=mvindex(messages_ready,0) | eval queue=mvindex(name,0) | bucket _time span=1m | search queue_length > 1000 | stats count, avg(queue_length) as average_queue_length by queue | search count>=10
Search 2
index=* source="gateway.backend.log" Connection timed-out | bucket_time span=30m | stats count by _time | search count>20
... View more