https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-if-index-have-no-data-in-the-last-24/m-p/625995#M217588 <P>Thank you for your response. The problem is that I have several indexes which have not received any information in the last month. When I use this command, I get absolutely nothing. My purpose is to create a list of those indexes that have not received any information in the last 24 hours.</P> Thu, 05 Jan 2023 12:09:59 GMT Neonbeeflash 2023-01-05T12:09:59Z https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-if-index-have-no-data-in-the-last-24/m-p/623565#M216768 <P><SPAN>I want to create alert to check on all indexes event count and alert the list of&nbsp;</SPAN><STRONG>all indexes</STRONG><SPAN>&nbsp;that have no events in the last 24 hours.<BR /><BR />I saw a post with the same problem,&nbsp;but it didn't help.&nbsp;<A href="https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-create-an-alert-if-index-have-no-data-in-the-last-24/m-p/480781" target="_blank" rel="noopener">How to create an alert if index have no data in th... - Splunk Community</A>.&nbsp;<BR /><BR />The following search doesn't work for my purpose.&nbsp;<BR /></SPAN></P><PRE>| tstats count where index=* by index | where count = 0</PRE><P>&nbsp;</P> Wed, 07 Dec 2022 12:49:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-if-index-have-no-data-in-the-last-24/m-p/623565#M216768 Neonbeeflash 2022-12-07T12:49:53Z https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-if-index-have-no-data-in-the-last-24/m-p/623580#M216771 <P>Please elaborate on "doesn't work for my purpose".</P><P>Have you looked at the blog entry referenced in linked answer?</P> Wed, 07 Dec 2022 13:52:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-if-index-have-no-data-in-the-last-24/m-p/623580#M216771 richgalloway 2022-12-07T13:52:47Z https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-if-index-have-no-data-in-the-last-24/m-p/625995#M217588 <P>Thank you for your response. The problem is that I have several indexes which have not received any information in the last month. When I use this command, I get absolutely nothing. My purpose is to create a list of those indexes that have not received any information in the last 24 hours.</P> Thu, 05 Jan 2023 12:09:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-if-index-have-no-data-in-the-last-24/m-p/625995#M217588 Neonbeeflash 2023-01-05T12:09:59Z https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-if-index-have-no-data-in-the-last-24/m-p/626025#M217593 <P>I think you're getting no results because there's nothing for Splunk to find in empty indexes.&nbsp; Try this alternative query.</P><LI-CODE lang="markup">| tstats count where index=* by index ```Get a list of all indexes and assign them a count of zero``` | append [|rest /services/data/indexes | dedup title | fields title ```Discard internal indexes``` | search title!="_*" | rename title as index | eval count=0 ] ```Merge results, keeping the copy with a non-zero, if present``` | stats max(count) as count by index | where count==0</LI-CODE> Thu, 05 Jan 2023 16:06:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-if-index-have-no-data-in-the-last-24/m-p/626025#M217593 richgalloway 2023-01-05T16:06:49Z https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-if-index-have-no-data-in-the-last-24/m-p/626959#M217885 <P>Hello,<BR /><BR />This worked amazing! Thanks for your help.</P> Thu, 12 Jan 2023 17:29:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-if-index-have-no-data-in-the-last-24/m-p/626959#M217885 Neonbeeflash 2023-01-12T17:29:54Z