Sending alert if summary index fails

[richgalloway]

I have a scheduled search running every night to populate a summary index. This works well, but sometimes no data is found. I'd like to send an alert by email if the search returns no events. If I change the scheduled search alert condition from "always" to "if number of events = 0" won't I break my summary index? If so, how can I send an alert about the error case without a second search (or is that the only way to do it)?

[martin_mueller · Accepted solution]

Take a look at the _internal index around the time your scheduled summary search finishes, search for its name. You'll find an entry detailing its execution, along with the number of events returned by the search. Write an alert triggering if that number of events is zero.

[skender27]

Hi,

I didi it in this way:

index=_internal series="my_summary_index" | stats count as TotalSummary

Set alert (with email notification) if the result equals 0.

Hope it helps,
Skender