Regroup Alerts

[honolulu95]

Hello, please i need to know how i can create an alert that groups together several other alerts.
Or Maybe to create an alert regrouping 2 or 3 event logs in splunk.
Thank you.

[gcusello]

Hi @honolulu95,
could you better describe your need?

In Splunk every alert, report or dashboard panel is a search; so you cannot group more alerts, but maybe (I don't know your requirement) it's possible to create a search that contains the searches of more alerts.
e.g. if you need to check if there are logs from two different sources (eventually stored in different indexes), you don't need to create two alerts, you can create an alert that checks the two sources.
e.g. events from Windows and Linux OSs, stored in os and wineventlog index:

index=os OR index=wineventlog
| stats dc(index) AS count 
| where count<2

Ciao.
Giuseppe

[to4kawa]

There's no such feature.