Hello,
Need a suggestion to set up an alert for when a source stops sending Windows event data. Here is what I have so far, but is this sufficient?
index=windows host=#1 OR host=#2 OR host=#3 | stats count by host | where count<1
↧
