I have an alert that will trigger if a host does not respond for 60 minuets. I would like to be able to be able to specify sourcetypes so that we can have different allowances. e.g 1 day, 6 hours and 60 minuets. | metadata type=hosts | eval responsive=if(recentTime < now() - 60*60*3, "no", "yes") | eval defunct=if(recentTime > now() - 60*60*24*3, "no", "yes") | where responsive="no" | convert ctime(recentTime) as last_contact | fields host, responsive, defunct, last_contact | rename host as "Host" responsive as "Responsive" defunct as "Defunct" last_contact as "Last Update" Any advice on how I can achieve this? ... View more