https://community.splunk.com/t5/Alerting/Regroup-Alerts/m-p/486616#M8613 <P>Hi @honolulu95,<BR /> could you better describe your need?</P> <P>In Splunk every alert, report or dashboard panel is a search; so you cannot group more alerts, but maybe (I don't know your requirement) it's possible to create a search that contains the searches of more alerts.<BR /> e.g. if you need to check if there are logs from two different sources (eventually stored in different indexes), you don't need to create two alerts, you can create an alert that checks the two sources.<BR /> e.g. events from Windows and Linux OSs, stored in os and wineventlog index:</P> <PRE><CODE>index=os OR index=wineventlog | stats dc(index) AS count | where count&lt;2 </CODE></PRE> <P>Ciao.<BR /> Giuseppe</P> Tue, 05 May 2020 06:24:13 GMT gcusello 2020-05-05T06:24:13Z https://community.splunk.com/t5/Alerting/Regroup-Alerts/m-p/486614#M8611 <P>Hello, please i need to know how i can create an alert that groups together several other alerts. <BR />Or Maybe to create an alert regrouping 2 or 3 event logs in splunk.<BR />Thank you.</P> Tue, 09 Jun 2020 21:53:26 GMT https://community.splunk.com/t5/Alerting/Regroup-Alerts/m-p/486614#M8611 honolulu95 2020-06-09T21:53:26Z https://community.splunk.com/t5/Alerting/Regroup-Alerts/m-p/486615#M8612 <P>There's no such feature.</P> Mon, 04 May 2020 22:52:54 GMT https://community.splunk.com/t5/Alerting/Regroup-Alerts/m-p/486615#M8612 to4kawa 2020-05-04T22:52:54Z https://community.splunk.com/t5/Alerting/Regroup-Alerts/m-p/486616#M8613 <P>Hi @honolulu95,<BR /> could you better describe your need?</P> <P>In Splunk every alert, report or dashboard panel is a search; so you cannot group more alerts, but maybe (I don't know your requirement) it's possible to create a search that contains the searches of more alerts.<BR /> e.g. if you need to check if there are logs from two different sources (eventually stored in different indexes), you don't need to create two alerts, you can create an alert that checks the two sources.<BR /> e.g. events from Windows and Linux OSs, stored in os and wineventlog index:</P> <PRE><CODE>index=os OR index=wineventlog | stats dc(index) AS count | where count&lt;2 </CODE></PRE> <P>Ciao.<BR /> Giuseppe</P> Tue, 05 May 2020 06:24:13 GMT https://community.splunk.com/t5/Alerting/Regroup-Alerts/m-p/486616#M8613 gcusello 2020-05-05T06:24:13Z