I'm not entirely sure I understand your question. You need the vRLI agent installed, and through the query described in my article it detects when it has not seen N number of messages. Therefore you need to have hosts that are reporting to vRLI and define which ones in the alert.