How to write a search to alert if our Splunk Enterprise Security search head goes down?

[splunker9999]

Hi ,

We are looking to create an alert if for any reason a search head went down. This is for our Splunk Enterprise Security search head, since we have only one search head is available in our environment, we are looking to create an alert if the ES search head goes down.

Thanks

[ddrillic]

We use - | rest splunk_server=local /services/search/distributed/peers/ | where status!="Up" | fields peerName, status | rename peerName as Instance, status as Status

[splunker9999]

This is for search peers correct? can we use the same for search head,as we are looking for SH.