How to group alerts of same index with different sourcetypes into a single alert?

[sreenu92]

Hi Everyone,

I do have couple of alerts from the same index but with different sourcetypes that should trigger on the condition IF EVENT count > 0. Is there a way i could group them into a single alert by writing a single search?

Thanks Advance

[gpullis]

If each sourcetype's field names are unique, you could do:

index=A (sourcetype=st1 OR sourcetype=st2 OR sourcetype=st3 OR sourcetype=st4) | eval alertName=case(sourcetype==st1,"Alert1",sourcetype==st2,"Alert2",sourcetype==st3,"Alert3",sourcetype==st4,"Alert4") | eval column1=coalesce(field1,field3,field5,field7) | eval column2=coalesce(field2,field4,field6,field8) | dedup sourcetype, column1 | table alertName, column1, column2

[somesoni2]

Most probably you can. We need to see your alert searches to explore options to merge them.

[sreenu92]

It's like index=A sourcetype=st1|dedup field1|table field1,field2 --alert1 should send MSG like Alert1
index=A sourcetype=st2|dedup field3|table field3,field4 --alert2 should send MSG like Alert2
index=A sourcetype=st3|dedup field5|table field5,field6 --alert3 should send MSG like Alert3
index=A sourcetype=st4|dedup field7|table field7,field8 --alert4 should send MSG like Alert4

For every alert trigger condition would be if no of events> 0

As they all are from same index i would like to group them as a single alert which will gives a separate MSG for each alert if the condition is met.
Let say if condition of Alert1 and Alert2 is met it should give 2 messages but all of the Msg's are going to the same email BOX.

[somesoni2]

For alerting purpose, do you really need to do the dedup on those alerts searches? If you can get rid of that (as you just want to alert when there is a record available in the base search for each alert), they something like this could work.

index=A sourcetype=st1 OR sourcetype=st2 OR sourcetype=st3 OR sourcetype=st4 | dedup sourcetype | table field1 field2 field3....

Schedule this alert as any other alert and in "Action Options" section, select value for "When triggered, execute actions" as "per result". If you're creating the alert from Settings-> Searches, alerts and report, then select "Alert mode" as "Once per result".