Create an alert if the field values are null and mail it to specific person in dashboard??

[chitreshakumar]

I have a new requirement.I need to add an alert if any of the field contains NULL value .Then the alert should automatically send a mail to the respective members ??Please help me complete this

[gcusello · Accepted solution]

Hi chitreshakumar,
did you already created a search to obtain the result you want?
something like this:

index=my_index 
| eval check=case(isnull(field1),1,isnull(field2),1,isnull(field3),1)
| search check=1

if there's any null field you'll have results.

So you can schedule an alert and use send email as action.

Bye.
Giuseppe