How to trigger an alert when my search returns no 0 events from an index for the last 30 minutes?

[kjamsheed]

Trying to get an alert triggered when my custom search returns 0 events.
The search would include index, sourcetype, and custom field.

[sideview]

One solution would be this sort of search -

index=foo sourcetype=bar customField=baz | stats count | where count="0"

This will return 1 result row (with count=0) when there are no results, and it will return zero rows when there are any results.

So therefore you can just use default "trigger when there are some rows" behavior on your alert.