Need to create a alert for syslog message if the event doesn't appear more than 4 hours

[JoshiSaikiran]

We have a syslog message with specific keywords for e.g.. "content found". if the syslog message doesn't flow in log analytics. we need to create an alert for the syslog.

Appreciate your help on this one.

Thanks

[#2]

@JoshiSaikiran 

You will need to adjust the Column name if its not SyslogMessage and the string to search on 

Syslog
| where TimeGenerated > ago(4h)
| where SyslogMessage has "Failed to"

 or

Syslog
| where TimeGenerated > ago(4h)
| where SyslogMessage has_any ('Failed to','err')