Alerting

Can you capture and trigger an alert on the message in the GUI "No results found"

babcolee
Path Finder

I have seen a lot of questions and answers concerning fillnull and fillnull=0. However, I am unable to get my search to trigger an alert when the message appears in the GUI, "No results found". Based on the the time the log files are coming into our server, the timestamp of the events and when the the search is run I am seeing that message. I need it to trigger if I can capture that message or if the count=0
sourcetype=,mysourcetype | rex field=source "^[^.\n]\/(?P[^_]+)" | chart count by server | append [| gentimes start=-1 | eval server="" | table server | makemv server | mvexpand server ] | fillnull | stats max() as * by server

Tags (2)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try

sourcetype=,mysourcetype | rex field=source "^[^.\n]\/(?P[^_]+)" | chart count by server | append [| gentimes start=-1 | eval server="" | table server | makemv server | mvexpand server ] | fillnull | stats max() as * by server | appendpipe [| stats count | where count=0 | eval server="No data" ]

View solution in original post

0 Karma

babcolee
Path Finder

Thank you. That is exactly the output I needed

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

sourcetype=,mysourcetype | rex field=source "^[^.\n]\/(?P[^_]+)" | chart count by server | append [| gentimes start=-1 | eval server="" | table server | makemv server | mvexpand server ] | fillnull | stats max() as * by server | appendpipe [| stats count | where count=0 | eval server="No data" ]
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...