How to not send the alert when it does not contain any data

[aditsss]

Hi Everyone,

I have set one alert as below:

index=abc ns=c2 ("NullPointerException" OR "IllegalStateException" OR "RuntimeException" OR "IllegalArgumentException" OR "NumberFormatException" OR "NoSuchMethodException" OR "ClassCastException" OR "ParseException" OR "InvocationTargetException" OR "OutOfMemoryError")| rex "message=(?<ExceptionMessage>[^\n]+)"|eval _time = strftime(_time,"%Y-%m-%d %H:%M:%S.%3N")|cluster showcount=t t=0.9|table app_name, ExceptionMessage,cluster_count,_time, environment, pod_name,ns|dedup ExceptionMessage,pod_name|rename app_name as APP_NAME, _time as Time, environment as Environment, pod_name as Pod_Name,cluster_count as Count

And I am sending it through via mail.

My requirement is when there is no data no alert should be send .

Can someone guide me on that.

Thanks in advance

[rnowitzki · Accepted solution]

Hi @aditsss,

This should be already set if you use the default trigger condition.

There is an area in the alert setting where you set "Trigger alert when"  -> select "Number of Results"  -> select "is greater than" type in "0".

So it would only fire the alert, when there is at least one result.

Ralph