Below is the search that i have prepared to check for the host named nmshost01 not sending data for over 30 min
| metadata type=hosts index=* | search host="nmshost01"| eval age = now()-lastTime | where age > (1800)| sort age d | convert ctime(lastTime) |fields host,age
This search yields appropriate results. I am unable send any alert using this as events show 0 while statistics show the result.
What is the right option to select when we save as alert. The options i get in the drop down are :
1. per results
2. number of results
3. number of hosts
4. number of sources
5. custom
I have tried number of results but i don't get any alert triggered as events show 0 in metadata search
Your query will return a result only when the host hasn't reported in last 30mins -
| metadata type=hosts index=* | search host="nmshost01"| eval age = now()-lastTime | where age > 1800 | sort age d | convert ctime(lastTime) |fields host age lastTime
Hence the condition selected should be "number of events" greater than 0.