https://community.splunk.com/t5/Splunk-Search/Search-based-on-zero-events/m-p/745779#M241541 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/310018">@u_m1580</a>&nbsp;</P><P>I would look at using a tstats search as this will be more performant when there is data in the index.</P><P>Something simple such as:</P><LI-CODE lang="markup">|tstats count where index=&lt;yourIndex&gt;</LI-CODE><P>Then you can alert where count=0, or add a | where count&gt;0 and alert when there are no results.</P><P><span class="lia-unicode-emoji" title=":glowing_star:">🌟</span><SPAN>&nbsp;</SPAN><STRONG>Did this answer help you?</STRONG><SPAN>&nbsp;</SPAN>If so, please consider:</P><UL><LI>Adding karma to show it was useful</LI><LI>Marking it as the solution if it resolved your issue</LI><LI>Commenting if you need any clarification</LI></UL><P>Your feedback encourages the volunteers in this community to continue contributing</P> Thu, 08 May 2025 12:39:46 GMT livehybrid 2025-05-08T12:39:46Z https://community.splunk.com/t5/Splunk-Search/Search-based-on-zero-events/m-p/745769#M241535 <P>Hi there,</P><P>I would like to create a search to alert us based on an index not ingesting any event data by basing it off any field in our index</P> Thu, 08 May 2025 10:31:26 GMT https://community.splunk.com/t5/Splunk-Search/Search-based-on-zero-events/m-p/745769#M241535 u_m1580 2025-05-08T10:31:26Z https://community.splunk.com/t5/Splunk-Search/Search-based-on-zero-events/m-p/745770#M241536 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/310018">@u_m1580</a>&nbsp;,</P><P>you could create an alert using a simple search</P><LI-CODE lang="markup">index=&lt;your_index&gt;</LI-CODE><P>&nbsp;that triggers if you have no events.</P><P>If you need to check a list of hosts, it's different.</P><P>Ciao.</P><P>Giuseppe</P> Thu, 08 May 2025 10:33:51 GMT https://community.splunk.com/t5/Splunk-Search/Search-based-on-zero-events/m-p/745770#M241536 gcusello 2025-05-08T10:33:51Z https://community.splunk.com/t5/Splunk-Search/Search-based-on-zero-events/m-p/745779#M241541 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/310018">@u_m1580</a>&nbsp;</P><P>I would look at using a tstats search as this will be more performant when there is data in the index.</P><P>Something simple such as:</P><LI-CODE lang="markup">|tstats count where index=&lt;yourIndex&gt;</LI-CODE><P>Then you can alert where count=0, or add a | where count&gt;0 and alert when there are no results.</P><P><span class="lia-unicode-emoji" title=":glowing_star:">🌟</span><SPAN>&nbsp;</SPAN><STRONG>Did this answer help you?</STRONG><SPAN>&nbsp;</SPAN>If so, please consider:</P><UL><LI>Adding karma to show it was useful</LI><LI>Marking it as the solution if it resolved your issue</LI><LI>Commenting if you need any clarification</LI></UL><P>Your feedback encourages the volunteers in this community to continue contributing</P> Thu, 08 May 2025 12:39:46 GMT https://community.splunk.com/t5/Splunk-Search/Search-based-on-zero-events/m-p/745779#M241541 livehybrid 2025-05-08T12:39:46Z