https://community.splunk.com/t5/Alerting/Why-does-the-trigger-condition-for-my-alert-never-work/m-p/284003#M5243 <P>Hi @splunkrocks2014,<BR /> What software version are you using?</P> <P>What kind of alert did you create (real-time/scheduled)?</P> <P>This is more of experimental question, but could you possibly test the alert without the "table" command at the end? If you leave "table" out but use your original condition for events &gt; 0, does the alert trigger as expected?</P> Wed, 06 Apr 2016 00:15:09 GMT frobinson_splun 2016-04-06T00:15:09Z https://community.splunk.com/t5/Alerting/Why-does-the-trigger-condition-for-my-alert-never-work/m-p/284002#M5242 <P>Hi. </P> <P>I created an alert and tried to trigger a python script to capture the parameters if the alert condition is set as "if number of events" "is greater than" "0". However, the trigger condition never works until I set it as "Always". I have tried all different options to include custom set as "search count&gt;0", and none of them work, although there were results from the alert. Any clues?</P> <PRE><CODE>index=xyz sourcetype=xyz:abc c_host=myhostname | table c_ip cs_path </CODE></PRE> <P>start time: -5m<BR /> finish time: now</P> Tue, 05 Apr 2016 22:16:48 GMT https://community.splunk.com/t5/Alerting/Why-does-the-trigger-condition-for-my-alert-never-work/m-p/284002#M5242 splunkrocks2014 2016-04-05T22:16:48Z https://community.splunk.com/t5/Alerting/Why-does-the-trigger-condition-for-my-alert-never-work/m-p/284003#M5243 <P>Hi @splunkrocks2014,<BR /> What software version are you using?</P> <P>What kind of alert did you create (real-time/scheduled)?</P> <P>This is more of experimental question, but could you possibly test the alert without the "table" command at the end? If you leave "table" out but use your original condition for events &gt; 0, does the alert trigger as expected?</P> Wed, 06 Apr 2016 00:15:09 GMT https://community.splunk.com/t5/Alerting/Why-does-the-trigger-condition-for-my-alert-never-work/m-p/284003#M5243 frobinson_splun 2016-04-06T00:15:09Z https://community.splunk.com/t5/Alerting/Why-does-the-trigger-condition-for-my-alert-never-work/m-p/284004#M5244 <P>It works by removed "table" command. That means the condition doesn't support "table" command?</P> <P>Splunk Enterprise: 6.3.2<BR /> Alert: scheduled every 5 mins</P> Wed, 06 Apr 2016 14:06:07 GMT https://community.splunk.com/t5/Alerting/Why-does-the-trigger-condition-for-my-alert-never-work/m-p/284004#M5244 splunkrocks2014 2016-04-06T14:06:07Z https://community.splunk.com/t5/Alerting/Why-does-the-trigger-condition-for-my-alert-never-work/m-p/284005#M5245 <P>Hi Splunkrocks2014,</P> <P>The custom condition is typically set using the search command (see example: <A href="http://docs.splunk.com/Documentation/Splunk/6.1/Alert/Alertexamples">http://docs.splunk.com/Documentation/Splunk/6.1/Alert/Alertexamples</A>)</P> <P>I think you may need to change your base search a bit. If I understand your question correctly, you may be looking for something like this as your base search..</P> <PRE><CODE>index=xyz sourcetype=xyz:abc c_host=myhostname | stats count by c_ip, cs_path </CODE></PRE> <P>From here, you can create your alert, and set your custom condition to be something like "search count &gt; 0", or whatever number you like.</P> Thu, 07 Apr 2016 06:08:30 GMT https://community.splunk.com/t5/Alerting/Why-does-the-trigger-condition-for-my-alert-never-work/m-p/284005#M5245 jluo_splunk 2016-04-07T06:08:30Z