I have below multiple searches (approx 20) and want to set a single alert for all the results. Can this be done? What is the process?
1) source="server.log" Ship Request | stats count
2) source="server.log" Drop Request NOT ("XXXX") | stats count
all searches are from same source. trying to create a alert like below.
Ship Request - 234
Drop Request - 554
You could append the searches one after the other to get a single result with I presume one line per search, then set an alert for that humongous search.
Alternatively, since you're running on the same source you could extend the stats to include more than one column. Which one of these ways is nicer depends on the searches.