https://community.splunk.com/t5/Splunk-Search/Combining-multiple-searches/m-p/81562#M20685 <P>index=_audit action="alert_fired" ss_name=Alert1 OR ss_name=Alert2 OR ss_name=Alert3 | stats dc(ss_name) as alerts</P> <P>and you should fire the alert if alerts = 3</P> Mon, 28 Sep 2020 11:27:51 GMT imrago 2020-09-28T11:27:51Z https://community.splunk.com/t5/Splunk-Search/Combining-multiple-searches/m-p/81559#M20682 <P>I have three different (unique) searches which sends out alerts in case certain conditions are met. I want to send an alert if all the three alerts (as mentioned above) are fired for an escalation scenario. Please advice how this can be achieved.</P> Wed, 29 Feb 2012 16:05:52 GMT https://community.splunk.com/t5/Splunk-Search/Combining-multiple-searches/m-p/81559#M20682 anirbanukil 2012-02-29T16:05:52Z https://community.splunk.com/t5/Splunk-Search/Combining-multiple-searches/m-p/81560#M20683 <P>Perhaps you could create an alert which would search for those three alerts in</P> <P>index="_audit" action="alert_fired"</P> Mon, 28 Sep 2020 11:27:48 GMT https://community.splunk.com/t5/Splunk-Search/Combining-multiple-searches/m-p/81560#M20683 imrago 2020-09-28T11:27:48Z https://community.splunk.com/t5/Splunk-Search/Combining-multiple-searches/m-p/81561#M20684 <P>Thanks for the update but how can I search multiple alert names as an 'AND' condition. <BR /> Ex: Alert1 and Alert2 and Alert3 all have fired.</P> Wed, 29 Feb 2012 21:35:36 GMT https://community.splunk.com/t5/Splunk-Search/Combining-multiple-searches/m-p/81561#M20684 anirbanukil 2012-02-29T21:35:36Z https://community.splunk.com/t5/Splunk-Search/Combining-multiple-searches/m-p/81562#M20685 <P>index=_audit action="alert_fired" ss_name=Alert1 OR ss_name=Alert2 OR ss_name=Alert3 | stats dc(ss_name) as alerts</P> <P>and you should fire the alert if alerts = 3</P> Mon, 28 Sep 2020 11:27:51 GMT https://community.splunk.com/t5/Splunk-Search/Combining-multiple-searches/m-p/81562#M20685 imrago 2020-09-28T11:27:51Z