Wrote this search to solve this issue:
index=*cricket*|dedup team|table team| lookup playerslist player AS team OUTPUT player AS playermatch | where playermatch!="matched"
Wrote this search to solve this issue:
index=*cricket*|dedup team|table team| lookup playerslist player AS team OUTPUT player AS playermatch | where playermatch!="matched"
Find a suitable query to identify the data is coming to your indexer from the host. An example query could be like this
index=yourIndex sourcetype=yoursourcetype host=yourhost | head 1
Run the search for suitable timerange as per your threshold (like if you want to configure an alert if no data has come for 60 mins, use timerange as last 60 mins) and saved the search as alert. See more details here http://docs.splunk.com/Documentation/Splunk/6.2.4/Alert/Setupalertactions#Configure_email_notificati...
Thanks. This works in a search. but when i am saving it as an alert. i am not getting anything.
I want it to alert when the events found=0.