Hi, this should be simple, but its making my head hurt.
(index=myindex OR index=_internal) (myfield=* OR source=*dbx2*) | search myfield = * NOT "Caught exception Splunkd daemon is not responding"
At times, I have ran into issues with the splunkd not responding for DB2. I have the above search in an Alert. It fires when there are 0 rows within 10 minutes (there should always be at least one row in 10 min), but I don't want it to fire if it finds "Caught exception Splunkd daemon is not responding".
I think I'm going about this wrong. How can I make a conditional alert that only fires if 0 rows are returned in the search and does not contain "Caught exception Splunkd daemon is not responding"?
Thanks
Chris
Ok, as expected, I over thought this one. Since the Alert first when the return result is NOT 0, the doing this:
search myfield = * OR "Caught exception Splunkd daemon is not responding"
Works for my Alert (it wont fire if a Splunkd exception is returned).
Sorry,
Chris
Ok, as expected, I over thought this one. Since the Alert first when the return result is NOT 0, the doing this:
search myfield = * OR "Caught exception Splunkd daemon is not responding"
Works for my Alert (it wont fire if a Splunkd exception is returned).
Sorry,
Chris
Try this:
(index=myindex OR index=_internal) (myfield=* OR source=*dbx2*) NOT "Caught exception Splunkd daemon is not responding"