Splunk Search

How to achieve an alert for when the count is 0?

bapun18
Communicator

I am running a query |tstats count latest(_time) where index=abcd by host, my requirement is to create an alert when the count is 0, when there would be no event in the index. 

My problem is when there is no event I am not getting the count field as 0.

Labels (2)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

appendpipe to the rescue!  This is a common method used to create a event where one otherwise would not exist.

| tstats count latest(_time) where index=abcd by host 
| appendpipe [ stats count as count2 
  | eval count=0, host="N/A" 
  | where count2=0 
  | fields - count2
]

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

appendpipe to the rescue!  This is a common method used to create a event where one otherwise would not exist.

| tstats count latest(_time) where index=abcd by host 
| appendpipe [ stats count as count2 
  | eval count=0, host="N/A" 
  | where count2=0 
  | fields - count2
]

 

---
If this reply helps you, Karma would be appreciated.

bapun18
Communicator

what if I have 2 hosts rly01 and rly02 and I want to print 2 lines as below in case of no event for one host or two
host               count
rly01                0

rly02              1456

or vice versa

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Then we're looking at a different solution, one at which Splunk does not excel.  See https://www.duanewaddle.com/proving-a-negative/

---
If this reply helps you, Karma would be appreciated.
0 Karma

bapun18
Communicator

Thanks a lot

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...