I want to identify any host that doesn't have any events over a four hour period and create an alert. Having trouble extracting the individual host.
index=ind1
| timechart span=4h count by host
| where count = 0
| table host count time
↧