Alerting

Can you capture and trigger an alert on the message in the GUI "No results found"

babcolee
Path Finder

I have seen a lot of questions and answers concerning fillnull and fillnull=0. However, I am unable to get my search to trigger an alert when the message appears in the GUI, "No results found". Based on the the time the log files are coming into our server, the timestamp of the events and when the the search is run I am seeing that message. I need it to trigger if I can capture that message or if the count=0
sourcetype=,mysourcetype | rex field=source "^[^.\n]\/(?P[^_]+)" | chart count by server | append [| gentimes start=-1 | eval server="" | table server | makemv server | mvexpand server ] | fillnull | stats max() as * by server

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

sourcetype=,mysourcetype | rex field=source "^[^.\n]\/(?P[^_]+)" | chart count by server | append [| gentimes start=-1 | eval server="" | table server | makemv server | mvexpand server ] | fillnull | stats max() as * by server | appendpipe [| stats count | where count=0 | eval server="No data" ]

View solution in original post

0 Karma

babcolee
Path Finder

Thank you. That is exactly the output I needed

0 Karma

somesoni2
Revered Legend

Give this a try

sourcetype=,mysourcetype | rex field=source "^[^.\n]\/(?P[^_]+)" | chart count by server | append [| gentimes start=-1 | eval server="" | table server | makemv server | mvexpand server ] | fillnull | stats max() as * by server | appendpipe [| stats count | where count=0 | eval server="No data" ]

View solution in original post

0 Karma