is it possible to set up a single alert for 15 servers?

[Abilan1]

Hi,

I have 15 servers, I want to set up the same alert for the 15 servers. I am going to use a common search string to search in the all servers log. Is it possible to set up a single alert? also If I set up a single alert how come it will give me the server name in alert?

Thanks,
Abilan

[stephanefotso · Accepted solution]

Let suppose that the host field identify each server. Here yougo!

index=......  host=*  "JDESPECRESULT_JDBFAILED"|table host

Then set up a PerResult alert,

[Abilan1]

Hi Stephane,

Thanks for the help. can you please let me know why we are using Index here?

Regards,
Abilan..

[stephanefotso]

I was in the case, each server is forwarding data to the indexer. But in your case, there is no need to use the index.
Thanks

[woodcock]

Yes, mostly. You can do something like this:

... | stats count by server

Then in the Alert set it to trigger an alert for each event returned. I do not know about including the server name in the subject, though.

[Abilan1]

Thank you. I will check from my side..

[stephanefotso]

I think it is possible. Please what do you want exactly the alert to do with your 15 servers? And also, what is the search query your are using?

[Abilan1]

I am going to use this search string "JDESPECRESULT_JDBFAILED". If this string occurs in any of the server logs, I need the server name detail in the alert.