index=_audit action="alert_fired" ss_name=Alert1 OR ss_name=Alert2 OR ss_name=Alert3 | stats dc(ss_name) as alerts and you should fire the alert if alerts = 3 ... View more

I would add to this - the default size of the index is 500GB. When the index fills, Splunk rolls off the oldest data. If you are adding about 50 GB/day to the index, it will only hold about 10 days of data. If you have the disk space, you can simply make the index size bigger - that will fix your immediate problem. And yes, you can make your index enormous (petabytes are not uncommon) if you have the disk space. Splunk doesn't care. However, some of the other answers are good too - if you have that much data, you should think carefully about how to manage it. ... View more

Your linebreaking is broken and there is no sense talking about using your events as-is: you need to fix your events first. Read this (do NOT skim it) and act accordingly: http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Indexmulti-lineevents ... View more

That's good. Please use the "accept answer" checkbox next to one of the answers to accept it and mark the question as "answered". ... View more

Thanks a lot.... It worked... ... View more