Hello All,
Could you please let me know how to combine 3 searches in one alert ?
like i have 3 indexes index =a|table test |append [search index=b|table test]|append [search index=c|table test ]
I am not clear that what you want to achieve. Can you try below query and let me know if this is what you expected:
index =a OR index=b OR index=c |dedup test|table test
What is your alert condition
