How do I set an alert to trigger on a change in value of a count or distinct count with non-live data?

[vincenthlam_tek]

The Alert would not know what the value should be as it isn't statically established.

For Instance
There would be 2 hosts forwarding data (the local host and another host). I want to receive an alert when a new host is added (e.g. dc = 3)

OR, more importantly, when one stops forwarding (e.g. dc=1).

When the search runs every hour if it's been changed the trigger should activate.

Any help or insight on the matter would be greatly appreciated. Thanks

[skoelpin]

Check out MetaWoot, this may be exactly what you're looking for

https://splunkbase.splunk.com/app/2949/