https://community.splunk.com/t5/Getting-Data-In/How-to-alert-when-a-forwarder-is-not-sending-logs-by-source-type/m-p/270661#M51960 <P>Give this a try</P> <PRE><CODE>| tstats max(_time) as recentTime WHERE index=* sourcetype="PutYourSourceTypeHere" by host | where recentTime &lt; now() - 10800| eval lastSeen = strftime(recentTime, "%F %T") | fields + host lastSeen </CODE></PRE> Thu, 08 Sep 2016 21:39:19 GMT somesoni2 2016-09-08T21:39:19Z https://community.splunk.com/t5/Getting-Data-In/How-to-alert-when-a-forwarder-is-not-sending-logs-by-source-type/m-p/270660#M51959 <P>Hi </P> <P>How to alert when a host is not sending logs by source type? For now, I'm using the below search for hosts not reporting, but a when a single source of host is not reporting, how do I alert on that? Any suggestions?</P> <P>Search I'm using now:</P> <PRE><CODE>| metadata type=hosts | where recentTime &lt; now() - 10800| eval lastSeen = strftime(recentTime, "%F %T") | fields + host lastSeen </CODE></PRE> Thu, 08 Sep 2016 21:07:17 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-alert-when-a-forwarder-is-not-sending-logs-by-source-type/m-p/270660#M51959 kiran331 2016-09-08T21:07:17Z https://community.splunk.com/t5/Getting-Data-In/How-to-alert-when-a-forwarder-is-not-sending-logs-by-source-type/m-p/270661#M51960 <P>Give this a try</P> <PRE><CODE>| tstats max(_time) as recentTime WHERE index=* sourcetype="PutYourSourceTypeHere" by host | where recentTime &lt; now() - 10800| eval lastSeen = strftime(recentTime, "%F %T") | fields + host lastSeen </CODE></PRE> Thu, 08 Sep 2016 21:39:19 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-alert-when-a-forwarder-is-not-sending-logs-by-source-type/m-p/270661#M51960 somesoni2 2016-09-08T21:39:19Z