https://community.splunk.com/t5/Alerting/How-to-create-an-Alert-when-the-system-gives-0-results/m-p/427887#M7447 <P>Hi,</P> <P>Need to create a Alert where if Search produces zero results then alert should be send , this should be checked every 15 mins. Is there any internal log file on which this alert can be created so that it doesn't create overhead on the system.</P> Mon, 05 Aug 2019 20:39:17 GMT rashi83 2019-08-05T20:39:17Z https://community.splunk.com/t5/Alerting/How-to-create-an-Alert-when-the-system-gives-0-results/m-p/427887#M7447 <P>Hi,</P> <P>Need to create a Alert where if Search produces zero results then alert should be send , this should be checked every 15 mins. Is there any internal log file on which this alert can be created so that it doesn't create overhead on the system.</P> Mon, 05 Aug 2019 20:39:17 GMT https://community.splunk.com/t5/Alerting/How-to-create-an-Alert-when-the-system-gives-0-results/m-p/427887#M7447 rashi83 2019-08-05T20:39:17Z https://community.splunk.com/t5/Alerting/How-to-create-an-Alert-when-the-system-gives-0-results/m-p/427888#M7448 <P>Hi</P> <P>You can check the results given by an alert with the following:</P> <PRE><CODE>index=_internal sourcetype="scheduler" search_type=scheduled savedsearch_name="Your alert name" | where result_count=0 </CODE></PRE> <P>Hope it helps.</P> Mon, 05 Aug 2019 21:07:20 GMT https://community.splunk.com/t5/Alerting/How-to-create-an-Alert-when-the-system-gives-0-results/m-p/427888#M7448 jaime_ramirez 2019-08-05T21:07:20Z