Generic alert that I can apply to all hosts

[snowmizer]

I would like to be able to create an alert that will notify us if Splunk either 1)stops getting log data from a host or 2)gets more the x number of errors in a specified period.

I know that I can write a search/alert for each host however I would like to have one search/alert that monitors all hosts and pulls out the one host that is having issues.

Is this possible?

Thanks.

[woodcock]

Yes, you can do something like this:

err* OR warn* OR fatal | stats count by host | where count > YourErrorThreshold

Then schedule the alert to run periodically over your evaluation timespan (e.g. every 5 minutes for the last 5 minutes) and set the alert to trigger on "number of events > 0"