Splunk Search

How to set an alert for a search if the stats count=0?

bfilippi
New Member

Hi

I am counting events and want to raise an alert if it is equal to zero

source="ES.csv"  index="mdata" sourcetype="csv" | stats count

I would like it to raise an alert if stats count = 0

how do I do this?

Thanks

Tags (3)
0 Karma
1 Solution

jeffland
SplunkTrust
SplunkTrust

It's easier than that. Do the search

source="ES.csv" index="mdata" sourcetype="csv"

and set the alerting options to alert you when it does not return results.

View solution in original post

jeffland
SplunkTrust
SplunkTrust

It's easier than that. Do the search

source="ES.csv" index="mdata" sourcetype="csv"

and set the alerting options to alert you when it does not return results.

bfilippi
New Member

thanks, I will try it. As you said, very straightforward!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...