Hi Team,
i have a basic search, where i need to alert when particular process name not available in raw data or last 15 minutes data. Plz suggest how to get the trigger.
Thanks,
Vijay K.
Hi
Splunk is not good to found something which is not existing 😞 Here is one blog post about it https://www.duanewaddle.com/proving-a-negative/ maybe it helps you.
Other ideas could be found from these
r. Ismo
If you already have the search then click the "Save as" drop-down in the top-right corner of the window and choose "Alert". The trigger condition is set in the lower part of the subsequent form.