Alert for silent log source

[srijankafle]

Hi Team,

Can anyone provide an insight on how can we create an alert if a log source (Let's assume a principal.hostname) stops sending logs for 30 mins?