created lookup xx.csv i added four servers in the lookup file
| inputlookup xx.csv | eval count=0| table Host count| append [search[| inputlookup xx.csv]| stats count by Host]| stats sum(count) as Count by Host| where Count = 0
Like this:
| metadata type=hosts index=<YourIndexName>
| appendpipe [|inputlookup xxx.csv | eval lastTime = 0]
| dedup host
| eval lastDataDuration=(now()-lastTime)/60
| where lastDataDuration>YourThreshHoldIntegerNumberOfMinutesHere
There could be several streamlined methods of finding out if a host is down or is not sending events. Following are couple of those:
Using metadata command for scenario where your Host is running but Data is not getting in to SPLUNK (Created alert for a periodic schedule and time range like last 15 min etc)
| metadata type=hosts index=_internal
| eval lastEventDuration=(now()-lastTime)/60
| where lastDuration>15
Using REST API (provided you have access) for situation where host itself is down which would stop pinging Splunk server:
| rest /service/deployment/server/clients
| eval lastPingDuration=(now()-lastTime)/60
| where lastPingDuration>15