Sometimes there are problems in loading splunk dashboards (example: "results not found" Count shows "0" etc). Trying to alert team if there any issues in Splunk. Please help how can we achieve it?
You can add this to your panels' search SPL:
| appendpipe [
stats count
| where count==0
| rename COMMENT1of3 AS "Splunk sendemail ALWAYS sends email, even when no results found; we address this with 2 settings:"
| rename COMMENT2of3 AS "First, we put 'null()' in 'to' header when no results; this causes 'sendemail' to error."
| rename COMMENT3of3 AS "Last, we use 'graceful=true' so that the search does not log any error for that."
| eval valueForToHeader=if(isnotnull(count), "YourAdminEmailGoesHere@YourCompany.com", null())
| sendemail
to=$result.valueForToHeader$
graceful=true
| rename COMMENT AS "Throw away these events so as not to pollute the regular search events"
| where count != 0]