It's like index=A sourcetype=st1|dedup field1|table field1,field2 --alert1 should send MSG like Alert1 index=A sourcetype=st2|dedup field3|table field3,field4 --alert2 should send MSG like Alert2 index=A sourcetype=st3|dedup field5|table field5,field6 --alert3 should send MSG like Alert3 index=A sourcetype=st4|dedup field7|table field7,field8 --alert4 should send MSG like Alert4 For every alert trigger condition would be if no of events> 0 As they all are from same index i would like to group them as a single alert which will gives a separate MSG for each alert if the condition is met. Let say if condition of Alert1 and Alert2 is met it should give 2 messages but all of the Msg's are going to the same email BOX. ... View more