Alerting

How to trigger alert based on search not found?

DotTest37
Path Finder

I have been using "alerts to email" for a while already,, now I need to create an alert that triggers if a particular message is not seen on certain period.
Basically, I get a confirmation on Splunk via syslog after a script runs on one of my servers, and I need Splunk to tell me if the script didnt run on a particular day.

Thanks

Tags (1)
0 Karma

steven7537
Explorer

If you create your search as a scheduled/saved search, you can tell it to run every hour/day whatever. You can also tell it to send you an email if the results are equal to, greater than, less than, a certain number, i.e 0. You can also set how many times it triggers and alerts this email per search.

carasso
Splunk Employee
Splunk Employee

"... | stats count | search count=0"

Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...