Alert if no events seen in X hours

[chadroberts]

Using the following search:

|metadata type=hosts |sort lastTime|convert ctime(lastTime)|fields host,lastTime

I am able to get a list of all hosts and when the last time splunk saw an event from that host. What I would like to do is create a saved search based off of this sort of search that I can use as an alert if lastTime is greater than some number of hours for any particular host. I was imagining something along the lines of

|metadata type=hosts |sort lastTime|convert ctime(lastTime)|fields host,lastTime |where NOW - lastTime > 12h

Or something along those lines. Is there a function that would give me NOW (current date/time) and if so, is this the right approach to get what I'm after?

[Ledion_Bitincka · Accepted solution]

You're looking for the now() function in eval. The following search will alert you if there are any hosts that haven't sent any data for more than one hour (3600 seconds)

# compare last event's time to now 
|metadata type=hosts | eval since=now()-lastTime | search since>3600 |...

OR 
# compare indexer's time when last event came to now
|metadata type=hosts | eval since=now()-recentTime| search since>3600 |...

[chadroberts]

Awesome, exactly what I was looking for. Thanks!