How to create an alert if index have no data in the last 24 hours?

[Neonbeeflash]

I want to create alert to check on all indexes event count and alert the list of all indexes that have no events in the last 24 hours.

I saw a post with the same problem, but it didn't help. How to create an alert if index have no data in th... - Splunk Community. 

The following search doesn't work for my purpose. 

| tstats count where index=* by index | where count = 0

[richgalloway]

Please elaborate on "doesn't work for my purpose".

Have you looked at the blog entry referenced in linked answer?

[Neonbeeflash]

Thank you for your response. The problem is that I have several indexes which have not received any information in the last month. When I use this command, I get absolutely nothing. My purpose is to create a list of those indexes that have not received any information in the last 24 hours.

[richgalloway · Accepted solution]

I think you're getting no results because there's nothing for Splunk to find in empty indexes.  Try this alternative query.

| tstats count where index=* by index
```Get a list of all indexes and assign them a count of zero```
| append [|rest /services/data/indexes 
  | dedup title 
  | fields title 
  ```Discard internal indexes```
  | search title!="_*" 
  | rename title as index 
  | eval count=0
]
```Merge results, keeping the copy with a non-zero, if present```
| stats max(count) as count by index
| where count==0

[Neonbeeflash]

Hello,

This worked amazing! Thanks for your help.