@somesoni2 has a good idea, although I would do it even more simply: (1) create a lookup table that contains a list of the sourcetypes that need to be checked. (2) run the following search
| inputlookup sourcetype.csv
| eval recentTime = 0
| join type=left sourcetype [ metadata type=sourcetypes ]
| where recentTime < now() - 60
This would give you a list of all the sourcetypes in sourcetype.csv that have not seen new data in the last minute. If you wanted to check only one sourcetype, it gets even easier
| metadata type=sourcetypes
| where sourcetype = thesourcetypetocheck and recentTime < now() - 60
This search returns nothing if the sourcetype has received data, and a single event if it has not received data.
In both cases, you might want to set an alert condition of "number of results > 0".
Now, regarding event:message.in - this changes things. If the rule is "all of the sourcetypes in my list must have at least one event with event:message.in during the last minute" then the test needs to look like this (and the alert condition is still "number of results > 0"):
| inputlookup sourcetype.csv
| join type=left sourcetype [ search earliest=-1m event:message.in=* [ | inputlookup sourcetype.csv ]
| stats count by sourcetype]
| where count = 0
If the rule is "a particular sourcetype must have at list must have at least one event with event:message.in during the last minute" then this will do it
earliest=-1m event:message.in=* sourcetype=mysourcetype
For this last search, your alert condition should be "number of results = 0".
... View more
