https://community.splunk.com/t5/Getting-Data-In/get-source-files-not-updated-in-last-1-hour/m-p/220503#M98873 <P>Something like this should work `| where age&gt;3600 AND match(source, "/logs/(abc|def).</P> <P>You could also do something like this to limit to a specific host(s)</P> <PRE><CODE>index=* host=abc source=*abc* OR source=*def* earliest=-1h@h | stats count by source | where count=0 </CODE></PRE> Fri, 22 Apr 2016 14:56:20 GMT sundareshr 2016-04-22T14:56:20Z https://community.splunk.com/t5/Getting-Data-In/get-source-files-not-updated-in-last-1-hour/m-p/220502#M98872 <P>I want to get source files not updated in last 1 hour in specific host. Like in host java123 there are 2 logs /logs/abc.txt, /logs/def.txt. If they didn't update from past 1 hour i want an alert. how can i achive this.. I tried below one but it is showing all logs from all hosts.</P> <P>| metadata index=* type=sources | eval age = now()- lastTime | where age &gt; 3600</P> <P>How to specify search for specific source files.</P> Fri, 22 Apr 2016 14:00:16 GMT https://community.splunk.com/t5/Getting-Data-In/get-source-files-not-updated-in-last-1-hour/m-p/220502#M98872 nani2rahul 2016-04-22T14:00:16Z https://community.splunk.com/t5/Getting-Data-In/get-source-files-not-updated-in-last-1-hour/m-p/220503#M98873 <P>Something like this should work `| where age&gt;3600 AND match(source, "/logs/(abc|def).</P> <P>You could also do something like this to limit to a specific host(s)</P> <PRE><CODE>index=* host=abc source=*abc* OR source=*def* earliest=-1h@h | stats count by source | where count=0 </CODE></PRE> Fri, 22 Apr 2016 14:56:20 GMT https://community.splunk.com/t5/Getting-Data-In/get-source-files-not-updated-in-last-1-hour/m-p/220503#M98873 sundareshr 2016-04-22T14:56:20Z