You're correct that there is an assumption that at least one rig/host reported in the current period. As long as that is true, then current would be populated for all rigs.
If it is possible that no rigs reported in the current period (and there isn't a different alert for that...), then we can alter the where clause slightly and cover this case as well:
| where last>0 AND (isnull(current) OR current=0)
... View more