alert on zero result didn't work as expected

raindrop18 — Mon, 02 Jun 2014 17:35:02 GMT

I have this string and give me a correct count number but when I tried set on alert keep sending me false alert. my objective is to get alert when number of result on my case "logged in users" are zero for last 30min.

                    index="mysite" sourcetype="logged in users" | stats count

                  Earliest:-15m
                  Latest:now
                  Cron Expression:*/30 * * * *
                  Trigger if number of results: is less than 1

also tried equal to "0"

but keep getting alert, when I checked the search actually there are 100 results.

thanks.

Re: alert on zero result didn't work as expected

somesoni2 — Mon, 02 Jun 2014 17:40:42 GMT

The query that you're using will always return one row.

    index="mysite" sourcetype="logged in users" | stats count

Output:

Count
------
countValue

countValue=0 if there are no rows in the sourcetype.
Just get rid of "|stats" in your alert OR use alert based on count field value.

topic alert on zero result didn't work as expected in Alerting

alert on zero result didn't work as expected

Re: alert on zero result didn't work as expected