How to alert if the last indexed log from a host is older than 15 mins from the search time?

[pbsuju]

I have a requirement where a log file from my application hosts will get updated every 15 mins if the application is healthy. But there wont be any logs updated if there is any issue with the application. So wanted an alert from each host if the last indexed log from any host is more than 15 mins old. Appreciated any thoughts on it.

[nickhills]

The easiest way is to use the metadata command

|metadata type=hosts index=*|eval threshold=now()-900|where lastTime<threshold|eval lastEvent=strftime(lastTime, "%Y-%m-%d %H:%M:%S"|table host lastEvent