Hi, i got the below query, and alert should get triggered only when data is not avaiable from any one of the host_ips
i gave the time range as 24 hrs to now and alert condition = o and corn expression */30 * * * *
i am getting mail for every 30 mins, even if data is available.
index=advcf request=* host IN(abgc, efgh, jhty, hjyu,kjnb) | eval event_ct=1 | append [| makeresults | eval host="abgc, efgh, jhty, hjyu, kjnb" | rex field=host mode=sed "s/\s+//g" | eval host=split(host,",") | mvexpand host | eval event_ct=0 ] | stats sum(event_ct) AS event_ct BY host | where event_ct=0
The test for zero is already in the SPL
| where event_ct=0
so you want the alert to trigger when the SPL finds a zero count for a host. Therefore, trigger when the number of results is not zero.
There doesn't appear to be anything wrong with your search - can you share your alert configuration?
alert configuration means, like what you want me to share.???
Something like this
I believe you want the alert to trigger is the number of results is NOT zero. That is the error condition.
My requirement is that i should receive the mail when no data is available in the servers.
So my condition should be equal to 0 right???
Correct me if i am wrong.
The test for zero is already in the SPL
| where event_ct=0
so you want the alert to trigger when the SPL finds a zero count for a host. Therefore, trigger when the number of results is not zero.
thank you, it worked
So in the alert configuration, i need to mention number of results "is not equal to 0"
Please confirm.