How to create alert on if log message does not appear?

[batham]

Hi,

I have a splunk source which does have data ingestion from multiple servers, i want to setup an alert on that source on a specific condition that if a particular message does not appear for 6 hour alert should be triggered

below is an example to search the string

 index=index1 source = source1 host=host1 "got the message"

so if i dont find the message "got the message" for 6 hours i want to trigger an alert .

[smurf]

Hi,

I was dealt with a similar scenario.

I would use a lookup to get a list of servers. I would also add the threshold to the lookup (host, threshold) to future-proof it.

Then you can append the list and do some dudup/stats magic; or start with inputlookup and join your search. 

smurf