I have seen a lot of questions and answers concerning fillnull and fillnull=0. However, I am unable to get my search to trigger an alert when the message appears in the GUI, "No results found". Based on the the time the log files are coming into our server, the timestamp of the events and when the the search is run I am seeing that message. I need it to trigger if I can capture that message or if the count=0
sourcetype=,mysourcetype | rex field=source "^[^.\n]\/(?P[^_]+)" | chart count by server | append [| gentimes start=-1 | eval server="" | table server | makemv server | mvexpand server ] | fillnull | stats max() as * by server
Give this a try
sourcetype=,mysourcetype | rex field=source "^[^.\n]\/(?P[^_]+)" | chart count by server | append [| gentimes start=-1 | eval server="" | table server | makemv server | mvexpand server ] | fillnull | stats max() as * by server | appendpipe [| stats count | where count=0 | eval server="No data" ]
Thank you. That is exactly the output I needed
Give this a try
sourcetype=,mysourcetype | rex field=source "^[^.\n]\/(?P[^_]+)" | chart count by server | append [| gentimes start=-1 | eval server="" | table server | makemv server | mvexpand server ] | fillnull | stats max() as * by server | appendpipe [| stats count | where count=0 | eval server="No data" ]