email alert for time period that contains multiple items

[scr4tchfury]

I want to send an email alert only when the last X minutes of a log contains "net1 down", "net2 down", "net3 down", and "net4 down". The messages are on different lines. How can I do this with the Splunk search app? Right now I have it send me an alert with results for "net* down" and eyeball it to make sure not all 4 are there.

[lukejadamec · Accepted solution]

Schedule a search to run every 15 minutes

Set the alert to trigger if the result count is greater than 3

index=yourindex sourcetype=yoursourcetype  yourfield="*net1 down*" OR  yourfield="*net2 down*" OR  yourfield="*net3 down*" OR  yourfield="*net4 down*"  | dedup yourfield

[lukejadamec]

What is the field name that includes netxdown?

[scr4tchfury]

They are 4 different events.

[lukejadamec]

Are these different lines of the same event, or 4 different events?