Alerting

Create a scheduled alert which triggers mail to some id

chitreshakumar
Communicator

I want to create an alert .If any of the field is missing the values the search will output the table with all the values with missing particular field values .Then I need to send an mail whenever this alerts run.My requirement is run it daily and the output to the mail in csv format .
My search is returning the values when running .But the alert is not triggering when the number of result is greater than zero.

0 Karma
1 Solution

nickhills
Ultra Champion

I think it maybe helpful if you can provide some sample data, but let me give this a go anyway:

If I have understood, you have a search which generates a table of results. You want to trigger an alert if any field in the table is empty?

<your search> |table _time <your field>

What you can do is fill empty fields with a known value, which you can then search for, so your search would now be

<your search> |table _time <your field>|fillnull value="Data Missing"|search <your field>="Data Missing"

This will now render you a table of rows only where a field is missing.
An alert >0 can now be set as a threshold

If my comment helps, please give it a thumbs up!

View solution in original post

nickhills
Ultra Champion

I think it maybe helpful if you can provide some sample data, but let me give this a go anyway:

If I have understood, you have a search which generates a table of results. You want to trigger an alert if any field in the table is empty?

<your search> |table _time <your field>

What you can do is fill empty fields with a known value, which you can then search for, so your search would now be

<your search> |table _time <your field>|fillnull value="Data Missing"|search <your field>="Data Missing"

This will now render you a table of rows only where a field is missing.
An alert >0 can now be set as a threshold

If my comment helps, please give it a thumbs up!
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...