Metadata search should be faster, and capture hosts without recent events. Otherwise you may need to use a lookup to define your list of hosts.
| metadata type=hosts index=abc*
| search host=efg*
| eval warn=relative_time(now(), "-15m")
| eval crit=relative_time(now(), "-30m")
| eval status=case(recentTime >= warn, "Normal", recentTime < warn AND recentTime >= crit, "Warning", recentTime < crit, "Critical", 1==1, "Undefined")
| table host recentTime status totalCount
| eval recentTime=strftime(recentTime, "%c") ]
... View more