- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to trigger custom alert with source condition
PotatoDataUser
Explorer
11-18-2024
03:16 AM
I have a index with 7 sources of which I utilize 4 sources.
The alert outputs data to a lookup file as its alert function and is written something like this.
index=my_index source=source1 OR source=source2 OR source=source3 OR source=source4
stats commands
eval commands
table commands etc.
I want to configure the alert to run only when all the four sources are present.
I tried doing this.
But the alert isnt running even when all 4 sources are present.
Please help me on how to configure this.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
11-18-2024
03:33 AM
Is your search wide enough to cover events from all four sources? Does the alert trigger if you reduce it to 3?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
PotatoDataUser
Explorer
11-18-2024
03:36 AM
Yes the search covers all 4 sources, when I run the search manually and check the events I see all the 4 sources present.
