Event for when a log host or source fails

[jasrich]

Is there a way to configure an event to fire when a certain log host or source fails to send logs after a given amount of time?

Thanks.

[martin_mueller]

You could define a scheduled search that computes the number of events matching your criteria, and set an alert to trigger if that number is zero.

[Antioch]

I don't think this is going to be possible, alerting works on taking searchable data and sending an alert about its contents. If splunk doesn't have data to search from, it can't send an alert.