When your whole query (search and sub-search) doesn't return any result then the Alert will anyways will not trigger.
You do type=left join, so it will get the result always, even if there is no match in Crash log. You get a value out of the join which is specific to Crash log. If match is found, you will have a value for this field post join, else this field will be blank. Then you can have where condition to check blank value for this field.
For Example:
| dbxquery query="select * from zkpiv_lstm_score" connection="HANA_MLBSO" | table RCA_TO_REPORT SYSID HOST TIMESTAMP CPU_CONSUMERS MEMORY_CONSUMERS CPU SYSTEM_CPU MEMORY_USED MEMORY_ALLOCATION_LIMIT PING_TIME CONNECTION_COUNT BLOCKED_TRANSACTION_COUNT STATEMENT_COUNT COMMIT_ID_RANGE CS_READ_COUNT CS_WRITE_COUNT CS_MERGE_COUNT CS_UNLOAD_COUNT ACTIVE_THREAD_COUNT WAITING_THREAD_COUNT
| join type=left SYSID [ search index=mlbso_changelog (crash_context OR crash_stack OR crash_shortinfo) sourcetype = BWP_crashdumps NOT "Table of contents" earliest=-60m latest=now | fields SYSID, X, Y , Z| eval logX = "CrashLog"]
| table SYSID, logX, ......
| where isnull(logX)
... View more