Splunk alert with 4 host having 4 different error threshold

[cbiraris]

Hi Team,

Is there any way we can setup a single Splunk alert having 4 host servers with different error threshold -

for example.

I have 4 host server1, server2, server3, server4 

if there 10 error count occurs for  server1 it will raise alert stating server1 having 10 error
if there 20 error count occurs for  server2 it will raise alert stating server2 having 20 error
if there 5 error count occurs for  server3 it will raise alert stating server3 having 5 error
if there 10 error count occurs for  server4 it will raise alert stating server4 having 10 error


I know this can be possible by  setting up 4 separate alerts for each server. just wanted to know if we can setup single alert involving all condition together in one alert.  

Please help with sample search query.

Thank you,

[ITWhisperer]

Build the condition into the search you use for your alert such that you only get results if one (or more) of these conditions arises.