Other Usage

sendalert risk when there are no results

spy_jr
Explorer

Has anyone been able to use the "| sendalert risk ..." command from the correlation search query, even when the search returns no results?


I currently need to do this, but when there are no results I get the message "Error in 'sendalert' command: Alert script returned error code 3."

Is there a way to truncate (abort) the sendalert command when there are no results?

0 Karma

kiran_panchavat
Champion

@spy_jrCheck this community link for more details:- https://community.splunk.com/t5/Alerting/Error-Code-3/m-p/689100/highlight/true

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

spy_jr
Explorer

hello @kiran_panchavat  thanks!
I've been reviewing that post carefully, but I couldn't find a solution. Apparently they're talking about a custom script...
I'll keep you posted if anyone has ever found a solution to this case.

0 Karma

kiran_panchavat
Champion

@spy_jr 

This usually happens when there are 0 results from the preceding search. If the results are more than 0 then you'll not see this error. So its safe to ignore this.

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

spy_jr
Explorer

Thanks for the reply, I understand that the error is due to there being no results, but that is exactly what I require, that it does not throw an error when there are no results, since when saving my correlation search it always throws an error and never completes a search.

Is there any way to avoid this?

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...