I have a new requirement.I need to add an alert if any of the field contains NULL value .Then the alert should automatically send a mail to the respective members ??Please help me complete this
Hi chitreshakumar,
did you already created a search to obtain the result you want?
something like this:
index=my_index
| eval check=case(isnull(field1),1,isnull(field2),1,isnull(field3),1)
| search check=1
if there's any null field you'll have results.
So you can schedule an alert and use send email as action.
Bye.
Giuseppe
Hi chitreshakumar,
did you already created a search to obtain the result you want?
something like this:
index=my_index
| eval check=case(isnull(field1),1,isnull(field2),1,isnull(field3),1)
| search check=1
if there's any null field you'll have results.
So you can schedule an alert and use send email as action.
Bye.
Giuseppe