Alerting

email alert not sending when the condition is ""Number of Results is = 0"

Engager

I am having trouble with getting a email triggered for the following condition.
"Number of Results is = 0"
the search query is as follows.

index="xxxxx" sourcetype="syslog" earliest=-1d latest=now | stats count

the result of the search is :
count = 0 .

It is able to send other alerts.

0 Karma

Esteemed Legend

You have to set Trigger alert when = Custom and the condition box below this to be count = 0. The other setting counts the number of rows returned which in your case will always be 1 (not 0 the way that you were thinking).

0 Karma

Super Champion

while reading the post, all looks fine..

  • maybe, verify the mail address.
  • try adding this adding one more action - "Add to Triggered Alerts", so that you will know the alert got triggered or not.
  • maybe, verify the Alert Schedule.
  • It is able to send other alerts. // you mean, other email alerts are working fine?