I am using a query as below
| inputlookup lookup_name where (Environment=PROD) AND sourcetype="name"
| join type=inner Environment, host
[| savedsearch "name" | stats count as Total by Environment, App, host ]
| fillnull value=NULL Total | search Total=NULL
Lookup is having only 2 columns Environment & Host returning PROD & Server_name, the saved search returns approx 10000 rows. This alert runs every 15 minutes but many times gets triggered with NULL result even when the actual result is not NULL. Alert condition is that if Total=NULL comes up it will send email but 90% of them are false alarms. Is it because the saved search is taking time to output and splunk is having some threshold appending just NULL in case it exceeds.
