https://community.splunk.com/t5/Alerting/Alert-Field-no-longer-reporting-data/m-p/478621#M8488 <PRE><CODE>index=your_index interestingField="*" </CODE></PRE> <P>To fire alert, <CODE>eventcount=0</CODE></P> Tue, 25 Feb 2020 09:43:03 GMT to4kawa 2020-02-25T09:43:03Z https://community.splunk.com/t5/Alerting/Alert-Field-no-longer-reporting-data/m-p/478620#M8487 <P>Is there a way to make an alert when a interesting field is no longer sending data? </P> Mon, 24 Feb 2020 22:04:11 GMT https://community.splunk.com/t5/Alerting/Alert-Field-no-longer-reporting-data/m-p/478620#M8487 alexrod03 2020-02-24T22:04:11Z https://community.splunk.com/t5/Alerting/Alert-Field-no-longer-reporting-data/m-p/478621#M8488 <PRE><CODE>index=your_index interestingField="*" </CODE></PRE> <P>To fire alert, <CODE>eventcount=0</CODE></P> Tue, 25 Feb 2020 09:43:03 GMT https://community.splunk.com/t5/Alerting/Alert-Field-no-longer-reporting-data/m-p/478621#M8488 to4kawa 2020-02-25T09:43:03Z