How do I write the same search that populates the "Data Summary"?

I need the event data from the "Data Summary" because I need to create a search to find when hosts stop sending logs to our Splunk server via UDP syslog. Thanks.