For alerting purpose, do you really need to do the dedup on those alerts searches? If you can get rid of that (as you just want to alert when there is a record available in the base search for each alert), they something like this could work. index=A sourcetype=st1 OR sourcetype=st2 OR sourcetype=st3 OR sourcetype=st4 | dedup sourcetype | table field1 field2 field3.... Schedule this alert as any other alert and in "Action Options" section, select value for "When triggered, execute actions" as "per result". If you're creating the alert from Settings-> Searches, alerts and report, then select "Alert mode" as "Once per result". ... View more