Is there a way to trigger a email/alert for when a cron expression time frame has ended and no alerts triggered?

[dcephas]

I currently have a search that takes two time/date intervals from the same event and subtracts them to get a value. If that value is longer than one hour an alert will be triggered. In the cron expression I have set the time to run for every day 4am to 12 pm.

What I want to know is if there is a way to also trigger an alert / email if after the alert time frame has past and no alerts were triggered.

The purpose is just to allow me to know there was no issue within that time frame of 4am to 12pm.

Obviously not getting an alert or email should suffice but less technical users would benefit from a confirmation email.

[aberkow]

Based on @adonio's idea:

index=_internal savedsearch_id="{savedSearchName}" earliest=-8h result_count>0
| stats count

And alert when the count is 0, running at 12 PM (or whatever time frame you want). Do a fuzzy search for the savedSearchName if you haven't worked with the _internal index before, ours followed something like user;app;name as the format.

Hope this helps!

[adonio]

you can search for the triggered alert for that time frame, do | stats count if count is 0, then no alerts occurred