Alerting

How to trigger alert when one row of list equals to zero

thinhdinh
Path Finder

Hi Experts,

I have a search query that give me a result table like below:

EmployeeSalary
A1000
B2000
C0

 

How can we trigger an alert when one of our employee's salary equals to zero or specific number?

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Sorry: wrong click!

you have to add a condition at the end of your search, e.g.:

| where Salary=0

and run an alert triggered when you have results.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @thinhdinh ,

you have to add a condition at the end of your search, e.g.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Sorry: wrong click!

you have to add a condition at the end of your search, e.g.:

| where Salary=0

and run an alert triggered when you have results.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...