Knowledge Management
Highlighted

Sending alert if summary index fails

SplunkTrust
SplunkTrust

I have a scheduled search running every night to populate a summary index. This works well, but sometimes no data is found. I'd like to send an alert by email if the search returns no events. If I change the scheduled search alert condition from "always" to "if number of events = 0" won't I break my summary index? If so, how can I send an alert about the error case without a second search (or is that the only way to do it)?

---
If this reply helps you, an upvote would be appreciated.
Highlighted

Re: Sending alert if summary index fails

SplunkTrust
SplunkTrust

Take a look at the _internal index around the time your scheduled summary search finishes, search for its name. You'll find an entry detailing its execution, along with the number of events returned by the search. Write an alert triggering if that number of events is zero.

View solution in original post

Highlighted

Re: Sending alert if summary index fails

Contributor

Hi,

I didi it in this way:

index=_internal series="my_summary_index" | stats count as TotalSummary

Set alert (with email notification) if the result equals 0.

Hope it helps,
Skender

0 Karma