Hi
How to alert when a host is not sending logs by source type? For now, I'm using the below search for hosts not reporting, but a when a single source of host is not reporting, how do I alert on that? Any suggestions?
Search I'm using now:
| metadata type=hosts | where recentTime < now() - 10800| eval lastSeen = strftime(recentTime, "%F %T") | fields + host lastSeen
Give this a try
| tstats max(_time) as recentTime WHERE index=* sourcetype="PutYourSourceTypeHere" by host | where recentTime < now() - 10800| eval lastSeen = strftime(recentTime, "%F %T") | fields + host lastSeen