Two Questions From Newbie

[rbtrary]

1. How do I make my search string more readable?  It only works if it's all on one line.  I tried escaping new lines but splunk complains.

2. My query creates tables ok.  I want an alert to happen if one of the table entries is zero.   so I added.

blah blah | sort + "Appointments Processed" | where 'Appointments Processed' = 0

and "save as" an alert

but when it is zero, it doesnt send me email alert?

[richgalloway]

1. Click on your query and type Ctrl-\ to automatically reformat your query into a more readable form.  Do not use continuation characters or escapes to start a new line - just start a new line

2. Tell us more.  Does the search return results?  What is the alert trigger?  What is the alert action?  Is email configured on your Splunk SH?  Have you checked the logs?

[rbtrary]

thank u Rich Galloway for the prompt reply

1. I hi-lite my search string in Edit Search and click Ctrl-\  everything is still on one line?

2. Yes search returns a table of results.

Alert trigger is "where Appointment Reminders = 0"

Alert action is to send an email.

email configured on splunk sh ? is that global?

where do we find the logs?

[richgalloway · Accepted solution]

There's no need to highlight anything.  Just make sure the cursor is in the search box before typing CTRL-\.

I've had better results by putting my alert criteria in the search and having the alert trigger when the number of results is not zero.  IOW, make the last command of your search be 

| where Appointment Reminders = 0

and have the alert send email when results are returned.

Email settings are global.  They tell Splunk where your SMTP server is, among other things.  Without them there's no telling where emails go, if anywhere.

Logs are in index=_internal and in $SPLUNK_HOME/var/log on the SH.