Splunk Search

How to set an alert for a search if the stats count=0?

New Member

Hi

I am counting events and want to raise an alert if it is equal to zero

source="ES.csv"  index="mdata" sourcetype="csv" | stats count

I would like it to raise an alert if stats count = 0

how do I do this?

Thanks

Tags (3)
0 Karma
1 Solution

Champion

It's easier than that. Do the search

source="ES.csv" index="mdata" sourcetype="csv"

and set the alerting options to alert you when it does not return results.

View solution in original post

Champion

It's easier than that. Do the search

source="ES.csv" index="mdata" sourcetype="csv"

and set the alerting options to alert you when it does not return results.

View solution in original post

New Member

thanks, I will try it. As you said, very straightforward!

0 Karma