How do I alert or highlight no logs over an interval?

[gsmith]

@magordon
Hello,

@magordon

If the host is not generating any logs, I’d like to be able to highlight that on a dashboard, or trigger an alert?

Correct me if im wrong but I think your trying to do something like this?

Alerting/Notification when certain sources are not reporting

Here is a suggestion : Create an event definition that runs every X minutes (define X as you see fit). In aggregation, define a condition based on the card() of the “source” field. If it is anything less than your number of sources, fire an alert.

Hope that helps