Alerting

how to combine 3 searchs in one alert result ?

rakeshksingh
New Member

Hello All,

Could you please let me know how to combine 3 searches in one alert ?

like i have 3 indexes
index =a|table test |append [search index=b|table test]|append [search index=c|table test ]

0 Karma

ansif
Motivator

I am not clear that what you want to achieve. Can you try below query and let me know if this is what you expected:

index =a OR index=b OR index=c |dedup test|table test

0 Karma

vasanthmss
Motivator

What is your alert condition

V
0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...