Other Usage

Why is alert not triggering when string value is empty?

POR160893
Builder

Hi,

I have a Splunk alert where the trigger condition should be:

search ABC == ""


, where ABC is a string field and the alert is only triggered for records with such values as empty.

However, no alert is triggered so far.

What can I do?


Thanks.

Labels (4)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try with where command

| where isnull(ABC) OR ABC==""
0 Karma

POR160893
Builder

Hey,

The full search which this alert is based on is this:

index=XYZ
| eval _time = strptime(dv_sys_updated_on, "%Y-%m-%d")
| eval month=strftime(_time, "%m")
| eval quarter = case(
month>=2 AND month<=4, "Q1",
month>=5 AND month<=7, "Q2",
month>=8 AND month<=10, "Q3",
month>=11 OR month<=1, "Q4"
)
| eval year = if(month>=2, strftime(relative_time(now(), "@y+1y"), "%y"), strftime(now(), "%y"))
| eval quarter = "FY" . year . quarter
| search quarter =FY29

| dedup HGF



| eval assigned_user=if(RITM == "", "", assigned_user)
| fields _time, quarter, RITM,
| table _time, quarter, RITM




However, I am assuming one cannot put this entire query into the trigger condition for the alert?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The alert is essentially a report/search - the trigger is based on the results of the search - note that only the first result event is available to the trigger if you want to use fields from the search (as opposed to number of results, for example).

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...