If you set the condition to send emails even if the search does not yield results you should get a csv that contains the text: "No matching events found."   You can do that by selecting a "is less than" condition with a big number in the Trigger conditions: Make sure to select the "Allow Empty Attachment" option when setting up the Alert. Another option would be to add a dummy result to your search to make sure that you always get at least one result using a command like append:   index=_internal action!=search xuxuxuxux | head 1 | eval myfield="real value" | table _time myfield| append [ makeresults annotate=true | eval myfield="dummy" | table _time myfield ]   ... View more

looks like some permission troubles, check the file and directory permission and that the user running the Splunk UF is set correctly ... View more

Thank you both! that did the trick ... View more

You can add the command at the end | addinfo | table _raw info_* it will add to each event the field : info_max_time info_min_time info_search_time info_sid from time search details in epoch time. example : ... View more