All Apps and Add-ons

Splunk alert with 4 host having 4 different error threshold

Path Finder

Hi Team,

Is there any way we can setup a single Splunk alert having 4 host servers with different error threshold -

for example.

I have 4 host server1, server2, server3, server4 

if there 10 error count occurs for  server1 it will raise alert stating server1 having 10 error
if there 20 error count occurs for  server2 it will raise alert stating server2 having 20 error
if there 5 error count occurs for  server3 it will raise alert stating server3 having 5 error
if there 10 error count occurs for  server4 it will raise alert stating server4 having 10 error

I know this can be possible by  setting up 4 separate alerts for each server. just wanted to know if we can setup single alert involving all condition together in one alert.  

Please help with sample search query.

Thank you,

Labels (1)
Tags (2)
0 Karma


Build the condition into the search you use for your alert such that you only get results if one (or more) of these conditions arises.

Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...