Splunk Search

Multiple search results in one alert

nrao1
Engager

I have below multiple searches (approx 20) and want to set a single alert for all the results. Can this be done? What is the process?

1) source="server.log" Ship Request | stats count
2) source="server.log" Drop Request NOT ("XXXX") | stats count

all searches are from same source. trying to create a alert like below.

Ship Request - 234
Drop Request - 554

Tags (1)

martin_mueller
SplunkTrust
SplunkTrust

You could append the searches one after the other to get a single result with I presume one line per search, then set an alert for that humongous search.

Alternatively, since you're running on the same source you could extend the stats to include more than one column. Which one of these ways is nicer depends on the searches.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...