Create dashboard for hosts that have no results from a specific sourcetype

[croseberry]

Hey guys I'm trying to create a dashboard that shows any host with a group of specified hosts that are not returning data from a specific source type

So what I have been trying so far to no success is 

Index=xyz Host=abc  Sourcetype=def 
|  timechart span=30min count by host
Where count < 1
usenull=f useother=f

This won't show anything because it going to have no events to report but I'm not sure how I can create a variable base upon have no results back within a specific time then do a timechart base upon the new variable by host

Unless I'm going about this completely wrong lol please help 

[richgalloway]

Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/