We have a search which checks for a total count of failures in system in the last 24 hours:
index=mydata earliest=-24h| stats list(Summary) as "Summary", count(Summary) as SummaryCount
when a specific failures occur, the SummaryCount has a value of 1 or more than one.
Based on that we have created an alert to trigger with custom trigger condition:
search SummaryCount>=1 and AlertType =Scheduled and is scheduled to run every day, one time at 1 am.
and the Action Options, set was "Once"
Every time we run our search we get a result, so i was expecting there will be 1 alert everyday until the SummaryCount value is returned. But i got the alert only on 1 day and later it does not send any alert emails.
Can you please help? This is really urgent.
I suggest that you should simply use the normal trigger condition of
Number of Results > 0
Your custom search for the alert is broken in a couple of ways:
andmust be capitalized as
ANDin searches if you want a boolean comparison.
What this means is that your custom search will never return anything - so your alert will not fire.
As far as I can tell, you don't need a custom search for your alert at all. Change your settings as
suggested in the first paragraph and see what happens.
How about you update your alert like this and try.
index=mydata earliest=-24h| stats list(Summary) as "Summary", count(Summary) as SummaryCount | wher SummaryCount>0
-1d@d to @d
0 1 * * *
If number of events greater than 0