Splunk Search

Multiple search results in one alert

nrao1
Engager

I have below multiple searches (approx 20) and want to set a single alert for all the results. Can this be done? What is the process?

1) source="server.log" Ship Request | stats count
2) source="server.log" Drop Request NOT ("XXXX") | stats count

all searches are from same source. trying to create a alert like below.

Ship Request - 234
Drop Request - 554

Tags (1)

martin_mueller
SplunkTrust
SplunkTrust

You could append the searches one after the other to get a single result with I presume one line per search, then set an alert for that humongous search.

Alternatively, since you're running on the same source you could extend the stats to include more than one column. Which one of these ways is nicer depends on the searches.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...