How to create alerts to identify hosts that have not sent files in the last hour?

[kentscott10]

I am very new to splunk and have been searching for how to create alerts that identify hosts that do not send their files (might alert us to a network or system error). I have found some examples (files note sent between times, files not sent for a specific host, etc.) but i need this to run every hour and report all hosts that have not sent a file. Amy help would be appreciated.

[kentscott10]

Tried your suggestion and it does send out an alert but it does not lists the hosts that met the criteria. For example, right now I have 10 hosts and it is only one that did not send any files. Is there a way for the alert to identify which host(s) in the alert?

[somesoni2]

The query does give the name of the host. Just ensure you select checkboxes to include result in the alert email. See this http://docs.splunk.com/Documentation/Splunk/7.0.1/Alert/Emailnotification#Define_an_email_notificati...

[somesoni2]

Give this a try

| metadata type=hosts index=* | table host lastTime | where lastTime<relative_time(now(),"-1h@h") | eval "Last Reported On"=strftime(lastTime,"%F %T") | fields - lastTime

Run this every hour (e.g. cron: 11 * * * *)