Alerting

How to trigger alert based on search not found?

DotTest37
Path Finder

I have been using "alerts to email" for a while already,, now I need to create an alert that triggers if a particular message is not seen on certain period.
Basically, I get a confirmation on Splunk via syslog after a script runs on one of my servers, and I need Splunk to tell me if the script didnt run on a particular day.

Thanks

Tags (1)
0 Karma

steven7537
Explorer

If you create your search as a scheduled/saved search, you can tell it to run every hour/day whatever. You can also tell it to send you an email if the results are equal to, greater than, less than, a certain number, i.e 0. You can also set how many times it triggers and alerts this email per search.

carasso
Splunk Employee
Splunk Employee

"... | stats count | search count=0"

Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...