For this type of alert, you can specify your search criteria that you expect to be found (but alerted if not), and then add an aggregation to test if the count() is < 1:
I just did a quick test and verified this event is triggered as expected (when i disabled that log source for a minute):
