splunk - create alert for a specific host not sending data in last 30 min using metadata

[roysm619]

Below is the search that i have prepared to check for the host named nmshost01 not sending data for over 30 min

| metadata type=hosts index=* | search host="nmshost01"| eval age = now()-lastTime | where age > (1800)| sort age d | convert ctime(lastTime) |fields host,age

This search yields appropriate results. I am unable send any alert using this as events show 0 while statistics show the result.

What is the right option to select when we save as alert. The options i get in the drop down are :
1. per results
2. number of results
3. number of hosts
4. number of sources
5. custom

I have tried number of results but i don't get any alert triggered as events show 0 in metadata search

[dineshraj9]

Your query will return a result only when the host hasn't reported in last 30mins -

| metadata type=hosts index=* | search host="nmshost01"| eval age = now()-lastTime | where age > 1800 | sort age d | convert ctime(lastTime) |fields host age lastTime 

Hence the condition selected should be "number of events" greater than 0.