https://community.splunk.com/t5/Alerting/HOw-to-setup-alerts-for-2-differnt-condition-in-single-saves/m-p/412630#M11562 <P>yes it worked:) thanks</P> Tue, 11 Jun 2019 05:00:06 GMT ashanka 2019-06-11T05:00:06Z https://community.splunk.com/t5/Alerting/HOw-to-setup-alerts-for-2-differnt-condition-in-single-saves/m-p/412626#M11558 <P>trying to setup an alert for certificate expiry. First alert will say, certificate will expire on 90 days. How to setup next alert when the expiry days = 60 days within the same alert?</P> <P>ns=application_logs "Cert DN = CN=E3.certificate"<BR /><BR /> | table Number, DN,Date<BR /> | dedup Number, DN,Date<BR /> |eval dateDue=strptime('Date',"%a %b %d %H:%M:%S %Z %Y")<BR /> | eval days = round((dateDue-now())/86400)<BR /> | table Number, DN,Date,dateDue,days<BR /> | search days = 90</P> <P>Here i have setup an alert when condition satisfies expiry days = 90. I need to setup a another alert when expiry days = 60.</P> <P>First alert will be on when days = 90, next should be on days = 60</P> Tue, 11 Jun 2019 03:47:47 GMT https://community.splunk.com/t5/Alerting/HOw-to-setup-alerts-for-2-differnt-condition-in-single-saves/m-p/412626#M11558 ashanka 2019-06-11T03:47:47Z https://community.splunk.com/t5/Alerting/HOw-to-setup-alerts-for-2-differnt-condition-in-single-saves/m-p/412627#M11559 <P>Dear @ashanka,</P> <P>Try the below option. </P> <P>| search days = 90 OR days = 60</P> <P>Thanks .. </P> Tue, 11 Jun 2019 04:22:16 GMT https://community.splunk.com/t5/Alerting/HOw-to-setup-alerts-for-2-differnt-condition-in-single-saves/m-p/412627#M11559 Shan 2019-06-11T04:22:16Z https://community.splunk.com/t5/Alerting/HOw-to-setup-alerts-for-2-differnt-condition-in-single-saves/m-p/412628#M11560 <P>@ashanka add both conditions in the same search filter with <CODE>OR</CODE> condition so that records are returned in either case for 90 days and 60 days.</P> <PRE><CODE>&lt;yourCurrentSearch&gt; | search days=90 OR days=60 </CODE></PRE> Tue, 11 Jun 2019 04:24:02 GMT https://community.splunk.com/t5/Alerting/HOw-to-setup-alerts-for-2-differnt-condition-in-single-saves/m-p/412628#M11560 niketn 2019-06-11T04:24:02Z https://community.splunk.com/t5/Alerting/HOw-to-setup-alerts-for-2-differnt-condition-in-single-saves/m-p/412629#M11561 <P>Thanks shankar, it worked</P> Tue, 11 Jun 2019 04:59:52 GMT https://community.splunk.com/t5/Alerting/HOw-to-setup-alerts-for-2-differnt-condition-in-single-saves/m-p/412629#M11561 ashanka 2019-06-11T04:59:52Z https://community.splunk.com/t5/Alerting/HOw-to-setup-alerts-for-2-differnt-condition-in-single-saves/m-p/412630#M11562 <P>yes it worked:) thanks</P> Tue, 11 Jun 2019 05:00:06 GMT https://community.splunk.com/t5/Alerting/HOw-to-setup-alerts-for-2-differnt-condition-in-single-saves/m-p/412630#M11562 ashanka 2019-06-11T05:00:06Z