https://community.splunk.com/t5/Alerting/Alert-filter/m-p/575622#M13247 <LI-CODE lang="markup">| rex "Return Code (?&lt;returncode&gt;\d+)" | where isnotnull(returncode) AND returncode!=1</LI-CODE><P>Create an alert based on there being more than 0 results</P> Fri, 19 Nov 2021 11:44:34 GMT ITWhisperer 2021-11-19T11:44:34Z https://community.splunk.com/t5/Alerting/Alert-filter/m-p/575621#M13246 <P>Hi all,</P><P>What would be a simply approach to creating an alert based on the following log data:</P><P>The objective is to send an alert if the "Return Code" does not equal the number "1"</P><P># Reporting Started #<BR />#####################<BR /># Processing task 1<BR /># Processing task 2<BR /># Processing task 3<BR />#####################<BR /># Return Code 1</P><P>TIA</P><P>&nbsp;</P><P>&nbsp;</P> Fri, 19 Nov 2021 11:35:56 GMT https://community.splunk.com/t5/Alerting/Alert-filter/m-p/575621#M13246 danielrichards 2021-11-19T11:35:56Z https://community.splunk.com/t5/Alerting/Alert-filter/m-p/575622#M13247 <LI-CODE lang="markup">| rex "Return Code (?&lt;returncode&gt;\d+)" | where isnotnull(returncode) AND returncode!=1</LI-CODE><P>Create an alert based on there being more than 0 results</P> Fri, 19 Nov 2021 11:44:34 GMT https://community.splunk.com/t5/Alerting/Alert-filter/m-p/575622#M13247 ITWhisperer 2021-11-19T11:44:34Z