I have a scheduled search running every night to populate a summary index. This works well, but sometimes no data is found. I'd like to send an alert by email if the search returns no events. If I change the scheduled search alert condition from "always" to "if number of events = 0" won't I break my summary index? If so, how can I send an alert about the error case without a second search (or is that the only way to do it)?
Take a look at the _internal
index around the time your scheduled summary search finishes, search for its name. You'll find an entry detailing its execution, along with the number of events returned by the search. Write an alert triggering if that number of events is zero.
Hi,
I didi it in this way:
index=_internal series="my_summary_index" | stats count as TotalSummary
Set alert (with email notification) if the result equals 0.
Hope it helps,
Skender
Take a look at the _internal
index around the time your scheduled summary search finishes, search for its name. You'll find an entry detailing its execution, along with the number of events returned by the search. Write an alert triggering if that number of events is zero.