Monitor the absence or presence of logs based on the filter query you have saved.
To configure a Log Management Filter Frequency threshold:
Tip: Avoid setting the threshold check interval to a very short time, as this can degrade system performance. In general, setting the threshold check interval to less than five minutes is not advised.
Note: Notification policies are optional for most thresholds. If you do not select a notification policy, no notifications are generated for the threshold, but a dashboard report listing the out of threshold items still appears on the Alert Center Home page.
Warning: When Absence is selected, the threshold will be considered breached with a count of zero for enabled log sources that may not be collecting log data. This could result in excessive alerts and notifications depending on your Log Management and Alert Center settings and configuration.
Use the Applied Log Sources tab to which log source or sources this threshold should be applied: