Log sources not reporting in 24 hours

[Ghanayem1974]

anyone have an idea on how to write up a search that will provide details on which logsource stopped reporting for the last 24 hours?

[woodcock]

For hosts, like this (with very large timepicker value):

|metadata type=hosts
| eval age = now() - lastTime
| search age > 86400

[pradeepkumarg]

|metadata type=sources | eval age = now() - lastTime | search age > 86400

[Ghanayem1974]

thank you but do you know if there is a way to separate out the devices that are not reporting? meaning, if its a windows server i want to the actual server that is not reporting. hope this makes sense.