topic How to trigger custom alert with source condition in Splunk Cloud Platform https://community.splunk.com/t5/Splunk-Cloud-Platform/How-to-trigger-custom-alert-with-source-condition/m-p/704634#M3373 <P>I have a index with 7 sources of which I utilize 4 sources.<BR /><BR />The alert outputs data to a lookup file as its alert function and is written something like this.<BR /><BR />index=my_index&nbsp; source=source1 OR&nbsp;source=source2 OR&nbsp;source=source3 OR&nbsp;source=source4<BR />stats commands<BR />eval commands<BR />table commands etc.<BR /><BR />I want to configure the alert to run only when all the four sources are present.<BR />I tried doing this.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="PotatoDataUser_1-1731928388752.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/33499iFBC5F21D69FBB64D/image-size/medium?v=v2&amp;px=400" role="button" title="PotatoDataUser_1-1731928388752.png" alt="PotatoDataUser_1-1731928388752.png" /></span></P><P>But the alert isnt running even when all 4 sources are present.<BR /><BR />Please help me on how to configure this.</P><P><BR /><BR /></P> Mon, 18 Nov 2024 11:16:44 GMT PotatoDataUser 2024-11-18T11:16:44Z How to trigger custom alert with source condition https://community.splunk.com/t5/Splunk-Cloud-Platform/How-to-trigger-custom-alert-with-source-condition/m-p/704634#M3373 <P>I have a index with 7 sources of which I utilize 4 sources.<BR /><BR />The alert outputs data to a lookup file as its alert function and is written something like this.<BR /><BR />index=my_index&nbsp; source=source1 OR&nbsp;source=source2 OR&nbsp;source=source3 OR&nbsp;source=source4<BR />stats commands<BR />eval commands<BR />table commands etc.<BR /><BR />I want to configure the alert to run only when all the four sources are present.<BR />I tried doing this.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="PotatoDataUser_1-1731928388752.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/33499iFBC5F21D69FBB64D/image-size/medium?v=v2&amp;px=400" role="button" title="PotatoDataUser_1-1731928388752.png" alt="PotatoDataUser_1-1731928388752.png" /></span></P><P>But the alert isnt running even when all 4 sources are present.<BR /><BR />Please help me on how to configure this.</P><P><BR /><BR /></P> Mon, 18 Nov 2024 11:16:44 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/How-to-trigger-custom-alert-with-source-condition/m-p/704634#M3373 PotatoDataUser 2024-11-18T11:16:44Z Re: How to trigger custom alert with source condition https://community.splunk.com/t5/Splunk-Cloud-Platform/How-to-trigger-custom-alert-with-source-condition/m-p/704637#M3374 <P>Is your search wide enough to cover events from all four sources? Does the alert trigger if you reduce it to 3?</P> Mon, 18 Nov 2024 11:33:22 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/How-to-trigger-custom-alert-with-source-condition/m-p/704637#M3374 ITWhisperer 2024-11-18T11:33:22Z Re: How to trigger custom alert with source condition https://community.splunk.com/t5/Splunk-Cloud-Platform/How-to-trigger-custom-alert-with-source-condition/m-p/704639#M3375 <P>Yes the search covers all 4 sources, when I run the search manually and check the events I see all the 4 sources present.</P> Mon, 18 Nov 2024 11:36:43 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/How-to-trigger-custom-alert-with-source-condition/m-p/704639#M3375 PotatoDataUser 2024-11-18T11:36:43Z