Search based on zero events

[u_m1580]

Hi there,

I would like to create a search to alert us based on an index not ingesting any event data by basing it off any field in our index

[livehybrid]

Hi @u_m1580 

I would look at using a tstats search as this will be more performant when there is data in the index.

Something simple such as:

|tstats count where index=<yourIndex>

Then you can alert where count=0, or add a | where count>0 and alert when there are no results.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[gcusello]

Hi @u_m1580 ,

you could create an alert using a simple search

index=<your_index>

 that triggers if you have no events.

If you need to check a list of hosts, it's different.

Ciao.

Giuseppe