Alert trigger condition

[bhaskar5428]

i am trying to setup alert for one event , am running on query at specific time.

If there are 8 records , email should sent as Success , else it should sent as fail.

Currently i have setup a cron susessfully and reeivng proper alert. So now incase there less than 8 rows i need to get failure email i e missing

am unable to to find the settings for the same.  

[gcusello]

Hi @bhaskar5428,

let me understandd: you need an alert (or a report) that checks with a predefined frequency (e.g. one day) youe events and every time sends a message with "Success" or Failure", is this correct?

if this is your need, you should schedule a report or an alert like this:

index=your_index
| stats count
| append [| makeresults | eval count=0 | fields count ]
| stats sum(count) AS total
| eval status=if total=8,"Success","Failure")
| table status

if you defined an alert, you can pass the status value as a token to the content of the eMail.

Ciao.

Giuseppe