Catchall item trigger
I have a log where every entry represents a warning or worse. I have created a log item fetching data from that log and now I would like to create a trigger that always fires and creates a warning regardless of the content of the log item unless a trigger with higher severity fires on that log item. A catchall trigger (see attached image for reference).
For example say we have the following log item "System is down" and a trigger with severity panic firing on that particular line then the catchall warning trigger should not fire for that log item.
I have tried to make the catchall trigger dependent on the the more severe trigger; but this does not work because when the more severe trigger fires the catchall trigger will be disabled for all log lines (the catchall is of multi event generation type).
In addition I have also tried using global even correlation but both triggers fire and the events remain open (guessing this is related to the events firing at the same time, but not sure).
How can I create a catchall trigger for my use case ?
For example say we have the following log item "System is down" and a trigger with severity panic firing on that particular line then the catchall warning trigger should not fire for that log item.
I have tried to make the catchall trigger dependent on the the more severe trigger; but this does not work because when the more severe trigger fires the catchall trigger will be disabled for all log lines (the catchall is of multi event generation type).
In addition I have also tried using global even correlation but both triggers fire and the events remain open (guessing this is related to the events firing at the same time, but not sure).
How can I create a catchall trigger for my use case ?