How to combine queries to use for alert?

[vishwa]

I have 3 queries , i want to combine to one query so that i can use it for alert

Query1:
index=error-data  sourcetype=error:logs  source=https://error:appliocation.logs
"logs started"   "tarnsaction recevied"
[|inputlookup append=t  errorlogs.csv where error=2
|fields host
|format]
|stats count as "initial error logs "

Query2:
index=error-data  sourcetype=error:logs  source=https://error:appliocation.logs
" timeouterror" AND "failed logs confirmed "
[|inputlookup append=t  errorlogs.csv where error=2
|fields host
|format]
|stats count as "logs in transactions "

Query3:
index=error-data  sourcetype=error:logs  source=https://error:appliocation.logs
" application logs continuted"
[|inputlookup append=t  errorlogs.csv where error=2
|fields host
|format]
|stats count as "total failed"

[vishwa]

Hi @richgalloway .

, thank you it worked.

I have one more question is there any way I can restrict events in splunk

For example From the above query if I get 10 same logs in 1 hour

How can I write a query to fetch

only 5 records in 1 hour

[richgalloway]

I don't know how to do that.

[richgalloway]

See if this helps

index=error-data  sourcetype=error:logs  source=https://error:appliocation.logs
("logs started"   "tarnsaction recevied") OR (" timeouterror" AND "failed logs confirmed ") OR (" application logs continuted")
[|inputlookup append=t  errorlogs.csv where error=2
|fields host
|format]
| eval initialError=if(searchmatch("logs started" AND "tarnsaction recevied"),1,0)
| eval transLogs=if(searchmatch(" timeouterror" AND "failed logs confirmed "),1, 0)
| eval Failed=if(searchmatch(" application logs continuted"), 1,0)
|stats count(eval(initialError=1)) as "initial error logs ", count(eval(transLogs=1) as "logs in transactions", count(eval(failed=1) as "total failed"