In this chapter, we have discussed the growing importance of Splunk alerting and the different levels of doing so. In the current corporate environment, intelligent alerting and alert noise reduction are becoming more important due to machine sprawl, both horizontally and vertically. Then we discussed how to create intelligent alerts and manage them effectively, and also some methods of self-healing that I've used in the past, and the successes and consequences of such methods in order to assist in setting expectations. In the next chapter, we will talk about the anatomy of a search and then some key techniques that will help in real world scenarios. Many people understand search syntax. However, to use it effectively, (that is, to become a search ninja) is something much more evasive and continuous. I will use real-world use-cases in order to get the point across, such as merging two datasets at search time, and making the result set of two searches match each other in time.