I have a search which is returning statistics (not events).
I would like to generate alert and call custome bash script only in case where i have at least 1 statistic result like this:
While i do not want to call external script when having 0 statistic results like this:
Please keep in mind that for both we do have 1 event found - and that is irrelevant.
And can see: "Alerts use a saved search to look for events". But in my case i am not interested in events but statistics.
How to launch external script easily in case i have a match and statistic data is produced ?
Save the search as an alert, set the alert to trigger when there is more than zero results, and have the alert call your external script as an alert action.
I'd recommend doing that through the UI, but if you want to use savedsearches.conf directly these are some relevant settings:
http://docs.splunk.com/Documentation/Splunk/6.4.3/admin/savedsearchesconf#Notification_options - the value might be "number of events", but it's actually triggering based on number of results