How to alert when a forwarder is not sending logs by source type?

[kiran331]

Hi

How to alert when a host is not sending logs by source type? For now, I'm using the below search for hosts not reporting, but a when a single source of host is not reporting, how do I alert on that? Any suggestions?

Search I'm using now:

| metadata type=hosts | where recentTime < now() - 10800| eval lastSeen = strftime(recentTime, "%F %T") | fields + host lastSeen

[somesoni2]

Give this a try

| tstats max(_time) as recentTime WHERE index=* sourcetype="PutYourSourceTypeHere" by host  | where recentTime < now() - 10800| eval lastSeen = strftime(recentTime, "%F %T") | fields + host lastSeen