It seems like this would be a simple search with a "if no events, then alert" if I'm reading your request right. I would accomplish this using stats count, then in the alert condition, specify to alert if count=0 for any specific scan. Depending on your system you may have to adjust for index latency (shift scan window 1-2 minutes into the past).
sourcetype=eStreamer sensor=CORPSF01| stats count
You could improve the search from there by breaking it by something meaningful for instance "stats count by host", then you'd get an alert if any host stopped sending data rather than when the whole sourcetype went blank.
... View more