Can you capture and trigger an alert on the message in the GUI "No results found"

[babcolee]

I have seen a lot of questions and answers concerning fillnull and fillnull=0. However, I am unable to get my search to trigger an alert when the message appears in the GUI, "No results found". Based on the the time the log files are coming into our server, the timestamp of the events and when the the search is run I am seeing that message. I need it to trigger if I can capture that message or if the count=0
sourcetype=,mysourcetype | rex field=source "^[^.\n]\/(?P[^_]+)" | chart count by server | append [| gentimes start=-1 | eval server="" | table server | makemv server | mvexpand server ] | fillnull | stats max() as * by server

[babcolee]

Thank you. That is exactly the output I needed

[somesoni2 · Accepted solution]

Give this a try

sourcetype=,mysourcetype | rex field=source "^[^.\n]\/(?P[^_]+)" | chart count by server | append [| gentimes start=-1 | eval server="" | table server | makemv server | mvexpand server ] | fillnull | stats max() as * by server | appendpipe [| stats count | where count=0 | eval server="No data" ]