Combining multiple searches

[anirbanukil]

I have three different (unique) searches which sends out alerts in case certain conditions are met. I want to send an alert if all the three alerts (as mentioned above) are fired for an escalation scenario. Please advice how this can be achieved.

[imrago · Accepted solution]

Perhaps you could create an alert which would search for those three alerts in

index="_audit" action="alert_fired"

[imrago]

index=_audit action="alert_fired" ss_name=Alert1 OR ss_name=Alert2 OR ss_name=Alert3 | stats dc(ss_name) as alerts

and you should fire the alert if alerts = 3

[anirbanukil]

Thanks for the update but how can I search multiple alert names as an 'AND' condition.
Ex: Alert1 and Alert2 and Alert3 all have fired.