How do i trigger a search if results count of another search are greater than 0?

[jkat54]

I have data coming into an index that tells me when a load is complete... these files are named *_done.txt

I have data coming into the same index that tells me the counts of errors etc related to the loads.

I want to trigger an alert that contains the errors that occurred in the load but only after the load completes and splunk receives a file with source=*_done.txt.

How can I do this?

[jkat54 · Accepted solution]

[ 
makeresults count=1 
| eval trigger= [ search index=myindexsource=*_done.txt _index_earliest=-1h@h _index_latest=-0h@h | head 1 | stats count  | return $count]
| eval search=if( trigger > 0 , "Search to Run if results Count is greater than 0","search to run if results count is not greater than 0, could be null()")
]

I solved with the above

[jkat54]

You can use this approach too:

| where trigger>0
| map search=“search to trigger”