Splunk Search

How do you trigger an alert using stats count to return 0 when value is 0?

markhvesta
Path Finder

I have an alert that is not triggering because there are no events occurring for one of my search parameters. I would like to trigger when there are less than 10 events for "OtherChannelWithNoEvents", but when there are no events, no results are found for it and it is not triggered.

Here is the search:

sourcetype="databasesourcetype" 
|  eval Channel = case(ChannelCD == 3, "CSR", ChannelCD == 58 AND PartnerChannelDescriptor = "COR", "OtherChannelWithNoEvents")
| stats count by Channel
| search (Channel = OtherChannelWithNoEvents count <10)
OR (Channel = CSR count <200)
0 Karma

somesoni2
Revered Legend

Keep the same trigger condition and try this version of search (the appendpipe will add a rows when there is no data from stats. We use that row in your filter)

 sourcetype="databasesourcetype" 
 |  eval Channel = case(ChannelCD == 3, "CSR", ChannelCD == 58 AND PartnerChannelDescriptor = "COR", "OtherChannelWithNoEvents")
 | stats count by Channel
 | appendpipe [| stats count | where count=0 | eval Channel="No_Records"]
 | search (Channel = OtherChannelWithNoEvents count <10)
 OR (Channel = CSR count <200) OR (Channel="No_Records")
0 Karma

somesoni2
Revered Legend

What's your trigger condition? Do you also want to trigger alert when your base search doesn't have any results?

0 Karma

markhvesta
Path Finder

Trigger is count > 1 and Yes.

It is a low volume alert, so when Either of those two channels is lower than a certain threshold, even 0 it should trigger an alert.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...