Splunk query to Check when no value is returned

[masmi99]

Scenario:

Example query :  index=XXXX name=somefile | stats count(msg) as MESSAGE

The above query will always return some count.

I want to alert if the Message=0 for two consecutive 5 min interval over the last 15 min interval i.e. when no values are returned.

earliest=-15m if two out of three interval (5min) the message=0 i want to take some actions

[codebuilder]

Just add this to the end of your alert query:

| where result_count=0

[masmi99]

when i add where MESSAGE=0 it is not returning any result

As my intention is to check for last 15 min if two of 5 min interval does not get any result to do some other action

index=XXX name=file-XXX level<50
| bucket _time span=5m
| fillnull value=0
| stats count(msg) as MESSAGES by _time

tried this but this will provide the result as follows it skipped 3:25 when  the count was 0

2021-08-18 03:20:00	25
2021-08-18 03:30:00	139
2021-08-18 03:35:00	10

[codebuilder]

The problem with you query is that you are not eliminating events where "msg" has a non null value. That's why youre getting results with counts.

Try something like this:

index=XXX name=file-XXX | fields + msg level<50
| bucket _time span=5m
| fillnull value=0
| where msg=0
| stats count(msg) as MESSAGES by _time