Alert when count = 0

[SplunkUser5888]

Hi guys, I've seen similar questions and answers but can't get around them. My question is simple... I guess.

I am searching antivirus logs to see if the scan is being run daily. If it is not, then I would like to register and alert in Splunk. My search is as follows:

host=server2003-splu sourcetype=fs_notification index=_audit Defender\\Scans\\History action=update | stats count

I would like a way to have an alert if count = 0

Thanks for any help

[martin_mueller · Accepted solution]

Instead of computing the count yourself you can create an alert that runs daily and is triggered if the number of results is equal to zero.

[SplunkUser5888]

Thanks so much, I knew it had to be something simple, my bad

[SplunkUser5888]

PS: I've tried | where count<1 but that doesn't seem to work