Other Usage

How to create a report that checks all scheduled alerts/searches that are querying indexes that contain no data?

abhishekdubey00
Engager

I want to all saved search like Alerts or Reports which is Scheduled but after running the query the there is no event  or no data 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

What have you tried so far?

See if this helps

| rest splunk_server=local /services/search/jobs 
| fields author eai:acl.app label doneProgress eventCount resultCount 
| search doneProgress=1.0000 resultCount=0 
| table author eai:acl.app label eventCount resultCount
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...