Thank you for that. Here is my final query. Since we have to monitor 10 production servers, I saved this and created an alert that looks for 10 hosts. If Splunk stops receiving logs from any of the 10, the alert notifies us and works perfectly.
host=web10 OR host=web11 OR host=web12 OR host=web13 OR host=web14 OR host=soa20 OR host=soa21 OR host=soa22 OR host=soa23 OR host=soa24 earliest=-5m latest=now | stats count(host) by host