Alert whenever the devices is not sending traffic logs to splunk.

[jlayson]

index=pan* dvc_name="*" sourcetype="pan:traffic" OR sourcetype="pan:system"

how can I trigger an email alert if example 1 or multiple devices are not sending traffic logs after 24hrs. I tried using the alert with condition number of results but it's not sending logs. because splunk counts the result not by device and by logs it added all the results.

[PickleRick]

You must have a list to which you can compare your search results (for example - stored in a lookup, or generated from results from the day before).

Splunk cannot tell you what is not in the results.

[ppudota1]

try this

index=pan* dvc_name="*" sourcetype="pan:traffic" OR sourcetype="pan:system" | stats count by dvc_name | where count=0

in the alert condition select if number of results>0