You can design your search so that if everything is ok, it returns 0 rows. Then if it returns > 0 rows, this indicates an issue that fires the alert. You can do this by doing the first part suggested by skoelpin above, followed by this:
| where ERR>5
Then your alert can fire when number of results is > 0. We use this so the alert stays quiet unless the threshold (indicated by some rows coming back) is breached.