email alert not sending when the condition is ""Number of Results is = 0"

[alexchandb]

I am having trouble with getting a email triggered for the following condition.
"Number of Results is = 0"
the search query is as follows.

index="xxxxx" sourcetype="syslog" earliest=-1d latest=now | stats count

the result of the search is :
count = 0 .

It is able to send other alerts.

[woodcock]

You have to set Trigger alert when = Custom and the condition box below this to be count = 0. The other setting counts the number of rows returned which in your case will always be 1 (not 0 the way that you were thinking).

[inventsekar]

while reading the post, all looks fine..

• maybe, verify the mail address.
• try adding this adding one more action - "Add to Triggered Alerts", so that you will know the alert got triggered or not.
• maybe, verify the Alert Schedule.
• It is able to send other alerts. // you mean, other email alerts are working fine?