https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618803#M14341 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp;, thank for the info, as per the link provided without lookup file we cannot see the host data with 0 count. i got it.<BR />but now my requirement is how can i create an alert when no data coming from any one of the hosts.<BR />i created a below query for that, please let me know if this is correct</P><LI-CODE lang="markup">index=advcf request=* host IN(abgc, efgh, jhty, hjyu,kjnb) |stats count |where count=0</LI-CODE><P><BR /><BR /></P> Fri, 28 Oct 2022 21:43:25 GMT Ash1 2022-10-28T21:43:25Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618778#M14338 <P>Hi all,<BR /><BR />i have below query<BR /><BR /></P> <LI-CODE lang="markup">index=advcf request=* host=abgc host=efgh host=jhty host=hjyu host=kjnbh</LI-CODE> <P><BR /><BR />here i want the email alert to trigger when data is not coming from any one of the hosts.<BR />and i want to see that host name in a table format in the mail.<BR /><BR />how can i do that????</P> Fri, 28 Oct 2022 18:36:39 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618778#M14338 Ash1 2022-10-28T18:36:39Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618798#M14340 <P>Finding something that is not there is not Splunk's strong suit.&nbsp; See this blog entry for a good write-up on it.<BR /><BR /><A href="https://www.duanewaddle.com/proving-a-negative/" target="_blank">https://www.duanewaddle.com/proving-a-negative/</A></P> Fri, 28 Oct 2022 20:18:22 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618798#M14340 richgalloway 2022-10-28T20:18:22Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618803#M14341 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp;, thank for the info, as per the link provided without lookup file we cannot see the host data with 0 count. i got it.<BR />but now my requirement is how can i create an alert when no data coming from any one of the hosts.<BR />i created a below query for that, please let me know if this is correct</P><LI-CODE lang="markup">index=advcf request=* host IN(abgc, efgh, jhty, hjyu,kjnb) |stats count |where count=0</LI-CODE><P><BR /><BR /></P> Fri, 28 Oct 2022 21:43:25 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618803#M14341 Ash1 2022-10-28T21:43:25Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618806#M14342 <P>Just append some dummy records for each host and assign an event count of 0 to it. Instead of count, use sum to add up the results.</P><P>&nbsp;</P><LI-CODE lang="markup">index=advcf request=* host IN(abgc, efgh, jhty, hjyu,kjnb) | eval event_ct=1 | append [| makeresults | eval host="abgc, efgh, jhty, hjyu, kjnb" | rex field=host mode=sed "s/\s+//g" | eval host=split(host,",") | mvexpand host | eval event_ct=0 ] | stats sum(event_ct) AS event_ct BY host | where event_ct=0</LI-CODE><P>&nbsp;</P> Fri, 28 Oct 2022 23:09:35 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618806#M14342 johnhuang 2022-10-28T23:09:35Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618821#M14344 <P>I tried to use the below query but getting below error:</P><P>Error in 'search operator:rex': usage:regex[field=&lt;field&gt;]&lt;regex&gt;</P><P>&nbsp;</P> Sat, 29 Oct 2022 16:35:42 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618821#M14344 Ash1 2022-10-29T16:35:42Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618822#M14345 <P>That query will trigger an alert only if there are no results from all hosts.</P> Sat, 29 Oct 2022 16:47:26 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618822#M14345 richgalloway 2022-10-29T16:47:26Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618823#M14346 <P>Please share the query that produced the error message.&nbsp; Is that the complete error text?&nbsp; It appears to be incomplete and incorrect.</P> Sat, 29 Oct 2022 16:49:35 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618823#M14346 richgalloway 2022-10-29T16:49:35Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618824#M14347 <P>but i want the alert to be triggered when data is not coming from 1 host as well...</P> Sat, 29 Oct 2022 17:20:08 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618824#M14347 Ash1 2022-10-29T17:20:08Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618825#M14348 <P>I used the same query given the only change in the original query is host and index name change, and the error i posted is the complete error.</P> Sat, 29 Oct 2022 17:21:25 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618825#M14348 Ash1 2022-10-29T17:21:25Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618826#M14349 <P>my requirement is just i need to trigger an alert when data is not coming from any hosts.</P> Sat, 29 Oct 2022 17:22:18 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618826#M14349 Ash1 2022-10-29T17:22:18Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618827#M14350 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp;as u said the query i gave will trigger an alert only when data is not available in all 5 hosts.<BR />but i want the alert to be triggered even when data not there in 1 host as well<BR />can u please tune this query</P><PRE>index=advcf request=* host IN(abgc, efgh, jhty, hjyu,kjnb) |stats count |where count=0</PRE><P>&nbsp;&nbsp;</P> Sat, 29 Oct 2022 17:24:35 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618827#M14350 Ash1 2022-10-29T17:24:35Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618829#M14351 <P>Have you tried the query suggested by&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/190794">@johnhuang</a>&nbsp;?&nbsp; It looks good to me.</P> Sun, 30 Oct 2022 00:35:10 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618829#M14351 richgalloway 2022-10-30T00:35:10Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618841#M14352 <P>I tried to use the query but getting below error:</P><P>Error in 'search operator:rex': usage:regex[field=&lt;field&gt;]&lt;regex&gt;</P> Sun, 30 Oct 2022 13:04:27 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618841#M14352 Ash1 2022-10-30T13:04:27Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618843#M14353 <P>Interesting.&nbsp; The exact query, without changes, works fine for me.&nbsp; Please post the exact query you used.</P> Sun, 30 Oct 2022 13:42:46 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618843#M14353 richgalloway 2022-10-30T13:42:46Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618848#M14354 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp; they was a typo error in my original query, i noticed that, now the given query is working fine.<BR />Thanks a lot&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp; and&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/190794">@johnhuang</a>&nbsp; for making this done.<span class="lia-unicode-emoji" title=":smiling_face_with_smiling_eyes:">😊</span><BR />i accept this as a solution<BR /><BR /></P> Sun, 30 Oct 2022 18:28:18 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-trigger-an-alert-when-no-data-from-hosts/m-p/618848#M14354 Ash1 2022-10-30T18:28:18Z