Hi: I am trying to set up an alert at Splunk to send me an email when one of our web services is down. We use Java Spring Boot web service. Using Docker image at Rancher servers. I am new to Splunk. I need help creating the search string to create the alert. Say, abc is the web service name We use search string: index=xyz_nonprod sourcetype=abc-wsqa-logger The docker-compose.yml has the following info , -> splunk-token: ${SPLUNK_TOKEN} splunk-url: ${SPLUNK_URL} splunk-index: ${SPLUNK_INDEX} splunk-sourcetype: "abc-ws${APPLICATION_ENV }-logger" splunk-source: "HttpEventCollectorLogbackAppender" splunk-insecureskipverify: "true" tag: "{{.Name}}/{{.FullID}}" I found sample example to create the a search as index=_internal " error " NOT debug source=*splunkd.log* Need help to fit it in my case to set up an alert when service abc is down. What would be the search string? Thanks Nahid Chow ... View more