Splunk Search

How to make an alert if a result doesn't match?

danielgp89
Path Finder

Hello, I need your help!!!

I want to make an alert if a search doesn't accomplish a certain result!

Example:

index=mf MFSOURCETYPE=SYSLOG SYSLOGSYSTEMNAME=PLB1 OR PLB2 OR PLB3 OR PLB4 |stats count by SYSLOGSYSTEMNAME if that search doesn't bring me PLB1, PLB2, PLB3, PLB4 then alert me!

How can I make the search? I think I need to use the eval and if.

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

In the Save As Alert dialog, in the Trigger Conditions area, set the Trigger alert when value to Number of Results and Is equal to and 0.

View solution in original post

0 Karma

woodcock
Esteemed Legend

In the Save As Alert dialog, in the Trigger Conditions area, set the Trigger alert when value to Number of Results and Is equal to and 0.

0 Karma

danielgp89
Path Finder

Thanks for the help woodcock!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...