Alerting

How to trigger alert when one row of list equals to zero

thinhdinh
Path Finder

Hi Experts,

I have a search query that give me a result table like below:

EmployeeSalary
A1000
B2000
C0

 

How can we trigger an alert when one of our employee's salary equals to zero or specific number?

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Sorry: wrong click!

you have to add a condition at the end of your search, e.g.:

| where Salary=0

and run an alert triggered when you have results.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @thinhdinh ,

you have to add a condition at the end of your search, e.g.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Sorry: wrong click!

you have to add a condition at the end of your search, e.g.:

| where Salary=0

and run an alert triggered when you have results.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...