Triggers alerts with differents conditions on the result

[arnauld18]

How can i trigger my alert with different conditions on the result?

i want my alert not to be triggered if i have more than 9 results.

so i put this:  search count<9.

The problem is, even when there is no result in the search, like 0, the alert keep being triggered.

so i try this:  search count>0 and count<9. 

And it doesn't work.. can someone please help me?

[gcusello]

Hi @arnauld18,

insert the conditions in the main search and fire the alert when you have results, something like this:

your search
| stats count
| where count<9

in this way:

• if you have results, there's the condition to be fired in the alert,
• if there isn't any result (count=0 or count>= 9) the aler isn't fired.

Ciao.

Giuseppe

[arnauld18]

Thank you

[gcusello]

Hi @arnauld18,

if one solution solves your need, please accept it for the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[inventsekar · Accepted solution]

Hi @arnauld18 ...Please check .. 

try: base search |  where count<9 

and Alert condition --- When number of events > 0

or, try this--- base search | where count>0 AND count<9

~ Happy Splunking | Best Regards | Sekar | PS - Karma points appreciated! 

[arnauld18]

Thank you. I'm trying it rn