Splunk Search

Multiple search results in one alert

nrao1
Engager

I have below multiple searches (approx 20) and want to set a single alert for all the results. Can this be done? What is the process?

1) source="server.log" Ship Request | stats count
2) source="server.log" Drop Request NOT ("XXXX") | stats count

all searches are from same source. trying to create a alert like below.

Ship Request - 234
Drop Request - 554

Tags (1)

martin_mueller
SplunkTrust
SplunkTrust

You could append the searches one after the other to get a single result with I presume one line per search, then set an alert for that humongous search.

Alternatively, since you're running on the same source you could extend the stats to include more than one column. Which one of these ways is nicer depends on the searches.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...