Why is alert not triggering as expected?

[Vani_26]

Hi, i got the below query, and alert should get triggered only when data is not avaiable from any one of the host_ips

i gave the time range as 24 hrs to now and alert condition = o and corn expression */30 * * * *

i am getting mail for every 30 mins, even if data is available.

index=advcf request=* host IN(abgc, efgh, jhty, hjyu,kjnb)
| eval event_ct=1
| append [| makeresults 
    | eval host="abgc, efgh, jhty, hjyu, kjnb"
    | rex field=host mode=sed "s/\s+//g"
    | eval host=split(host,",")
    | mvexpand host
    | eval event_ct=0
    ]
| stats sum(event_ct) AS event_ct BY host
| where event_ct=0

[ITWhisperer]

There doesn't appear to be anything wrong with your search - can you share your alert configuration?

[Vani_26]

alert configuration means, like what you want me to share.???

[ITWhisperer]

Something like this

ITWhisperer_0-1667493763025.png

[Vani_26]

Vani_26_0-1667497496055.png

[richgalloway]

I believe you want the alert to trigger is the number of results is NOT zero.  That is the error condition.

[Vani_26]

My requirement is that i should receive the mail when no data is available in the servers.
So my condition should be equal to 0 right???

Correct me if i am wrong.

[richgalloway · Accepted solution]

The test for zero is already in the SPL

| where event_ct=0

so you want the alert to trigger when the SPL finds a zero count for a host.  Therefore, trigger when the number of results is not zero.

[Vani_26]

thank you, it worked

[Vani_26]

So in the alert configuration, i need to mention number of results  "is not equal to 0"
Please confirm.

Vani_26_0-1667521765928.png