sendalert risk when there are no results

[spy_jr]

Has anyone been able to use the "| sendalert risk ..." command from the correlation search query, even when the search returns no results?

I currently need to do this, but when there are no results I get the message "Error in 'sendalert' command: Alert script returned error code 3."

Is there a way to truncate (abort) the sendalert command when there are no results?

[kiran_panchavat]

@spy_jrCheck this community link for more details:- https://community.splunk.com/t5/Alerting/Error-Code-3/m-p/689100/highlight/true

[spy_jr]

hello @kiran_panchavat  thanks!
I've been reviewing that post carefully, but I couldn't find a solution. Apparently they're talking about a custom script...
I'll keep you posted if anyone has ever found a solution to this case.

[kiran_panchavat]

@spy_jr 

This usually happens when there are 0 results from the preceding search. If the results are more than 0 then you'll not see this error. So its safe to ignore this.

[spy_jr]

Thanks for the reply, I understand that the error is due to there being no results, but that is exactly what I require, that it does not throw an error when there are no results, since when saving my correlation search it always throws an error and never completes a search.

Is there any way to avoid this?