I have a scheduled search running every night to populate a summary index. This works well, but sometimes no data is found. I'd like to send an alert by email if the search returns no events. If I change the scheduled search alert condition from "always" to "if number of events = 0" won't I break my summary index? If so, how can I send an alert about the error case without a second search (or is that the only way to do it)?
--- If this reply helps you, an upvote would be appreciated.
Take a look at the _internal index around the time your scheduled summary search finishes, search for its name. You'll find an entry detailing its execution, along with the number of events returned by the search. Write an alert triggering if that number of events is zero.