Query for data sources not reporting an event in a specific time period.

[staparia]

Hi,

I would request a query where if a log source has stopped sending an event to splunk for a specific time period, it should alert me.

Example index=proxy sourcetype=test_5 not giving any result for last 15 mins.

[paramagurukarth]

index=*| stats count as event_count by sourcetype |append[|metadata type=sourcetypes index=* OR index=_*| eval event_count=coalesce(event_count, 0) | table sourcetype,event_count] | where event_count = 0

[renjith_nair]

@staparia ,

index=proxy sourcetype=test_5 earliest=-15m|stats count|where count > 0

Set an alert for 'No of events is less than 0'