I have an alert with timechart span=6h, where I need to check if there is no data for more than 6hours, I need to trigger an alert... How do I get that work?
Maybe instead of doing a trending search for no data, look into the metadata command to go by hosts, sourcetype, or source. Then make your alert based off of the hour last seen.
| metadata type=sourcetypes index=google
| sort recentTime desc
| convert ctime(recentTime) as Recent_Time
| eval hours_since = round((now() - recentTime) / 3600,2)