Splunk Search

Alert when count = 0

SplunkUser5888
Path Finder

Hi guys, I've seen similar questions and answers but can't get around them. My question is simple... I guess.

I am searching antivirus logs to see if the scan is being run daily. If it is not, then I would like to register and alert in Splunk. My search is as follows:

host=server2003-splu sourcetype=fs_notification index=_audit Defender\\Scans\\History action=update | stats count

I would like a way to have an alert if count = 0

Thanks for any help

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Instead of computing the count yourself you can create an alert that runs daily and is triggered if the number of results is equal to zero.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Instead of computing the count yourself you can create an alert that runs daily and is triggered if the number of results is equal to zero.

SplunkUser5888
Path Finder

Thanks so much, I knew it had to be something simple, my bad

0 Karma

SplunkUser5888
Path Finder

PS: I've tried | where count<1 but that doesn't seem to work

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...