Knowledge Management

Sending alert if summary index fails

richgalloway
SplunkTrust
SplunkTrust

I have a scheduled search running every night to populate a summary index. This works well, but sometimes no data is found. I'd like to send an alert by email if the search returns no events. If I change the scheduled search alert condition from "always" to "if number of events = 0" won't I break my summary index? If so, how can I send an alert about the error case without a second search (or is that the only way to do it)?

---
If this reply helps you, Karma would be appreciated.
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Take a look at the _internal index around the time your scheduled summary search finishes, search for its name. You'll find an entry detailing its execution, along with the number of events returned by the search. Write an alert triggering if that number of events is zero.

View solution in original post

skender27
Contributor

Hi,

I didi it in this way:

index=_internal series="my_summary_index" | stats count as TotalSummary

Set alert (with email notification) if the result equals 0.

Hope it helps,
Skender

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Take a look at the _internal index around the time your scheduled summary search finishes, search for its name. You'll find an entry detailing its execution, along with the number of events returned by the search. Write an alert triggering if that number of events is zero.

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...