Hi, Im setting up an alert for data flow the alert build is when the application is not running it will send us an alert and i use trigger condition in the alert.  here is the search query  | eval value1=if(like(sample, "value1"), 1,0), value2=if(like(sample, "value2"), 1,0), value3=if(like(sample, "value3"), 1,0) | stats sum(value1) as VALUE1, sum(value2) as VALUE2, sum(value3) as VALUE3 | table VALUE1, VALUE2, VALUE3   and for the alert condition i use this command  search VALUE1 = 0  "0" because in the sum it indicates that the 0 means data is not flowing in splunk meaning the application is down  Thanks in advance ... View more