https://community.splunk.com/t5/Alerting/Help-creating-alert-criteria/m-p/107780#M1561 <P>How about using <CODE>dedup</CODE>? In your search:</P> <PRE><CODE>... | dedup source </CODE></PRE> <P>and then create the &gt;=2 events alert condition as usual.</P> Wed, 25 Jul 2012 14:13:31 GMT Ayn 2012-07-25T14:13:31Z https://community.splunk.com/t5/Alerting/Help-creating-alert-criteria/m-p/107779#M1560 <P>I want to create an alert that will fire if Splunk see's a log message from two seperate sources in a 10 minute interval. For example one event from Source1 and one event from Source2. The problem i'm running into is that Source2 may send more than one event in a ten minute interval, but I only want the alert to fire if it see's at least one message from source1 and source2 in ten minutes. Anyone have any ideas?</P> Wed, 25 Jul 2012 14:11:20 GMT https://community.splunk.com/t5/Alerting/Help-creating-alert-criteria/m-p/107779#M1560 jedatt01 2012-07-25T14:11:20Z https://community.splunk.com/t5/Alerting/Help-creating-alert-criteria/m-p/107780#M1561 <P>How about using <CODE>dedup</CODE>? In your search:</P> <PRE><CODE>... | dedup source </CODE></PRE> <P>and then create the &gt;=2 events alert condition as usual.</P> Wed, 25 Jul 2012 14:13:31 GMT https://community.splunk.com/t5/Alerting/Help-creating-alert-criteria/m-p/107780#M1561 Ayn 2012-07-25T14:13:31Z