How to set up an alert with If else condition in search?

[bosseres]

Hello everyone,

I want to make search that searches events in index1, and if it finds event, search should take field from it, and make search with this field in another one index. If there are 0 events with this field - then alert. It is possible?

[ITWhisperer]

Yes, first set up a report which find the results you want, then save it as an alert that is triggered if there are no results.

<search second index> [<search first index> | dedup field | fields field]

[bosseres]

and what if I need to alert only if my subsearch find events in first index? 

I mean if there are events in index1, and no events in index2 - alert

No events in index1 and no events in index2 - no alert?

[ITWhisperer]

Essentially, the subsearch is acting as a filter on the outer search - if the filter has no rows, then you should ensure that the outer search returns event (which it should otherwise you have nothing to filter anyway) - therefore, it should be OK - try it and see.

[bosseres]

I didn't quite get your point, you suggest to create report which find event in index1, and after by them find events in index2, what need to create alert?

and I didn't get why it will work if there are no events in index1

[ITWhisperer]

You need a single report to create the alert from

Here is a runanywhere example of what I mean

``` Create 20 events ```
| makeresults count=20
``` Each with a random letter A-G ```
| eval field=mvindex(split("ABCDEFG",""),random()%7)
``` This represents your data set for your outer search ```
| search
    ``` Filter the search using your inner search to return the field value you are looking for ```
    [| makeresults
    | fields - _time
    ``` In this case, the field value found is a random letter A-H ```
    | eval field=mvindex(split("ABCDEFGH",""),random()%8)
    ``` This will return zero rows if H is found by the inner search ```
    | where match("ABCDEFG",field)
    | appendpipe
        [stats count
        | where count = 0
        ``` If there are zero rows from the inner search, set the field value to * ```
        | eval field="*"]
    | fields field]

Run this a few times to see different results due to randomness of the dataset

You should see that sometimes you get only events with the same letter - this represents finding the value from the inner search in the outer search

Sometimes you will get events with all the letters - this represents finding no rows in the inner search

Sometimes you will get zero rows - this represents finding a value in the inner search which is not in the outer search.

If you set an alert based on the report returning zero rows, this is the third condition, which I think is the one you are interested in.

If this is not what you are after, please explain what the difference is