Hi @u_m1580  I would look at using a tstats search as this will be more performant when there is data in the index. Something simple such as: |tstats count where index=<yourIndex> Then you can alert where count=0, or add a | where count>0 and alert when there are no results. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more