https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-for-when-a-given-event-is-NOT-followed/m-p/178359#M2988 <P>I've searched through this site and on Google, but can't find an answer to this. Here is the scenario: I have a physical security system that monitors door states (opened or closed). When a door is opened, an Open event is sent to Splunk from this system. When the door closes, a Close event is sent to Splunk. I want to design an alert in Splunk that will trigger if an Open event is received, AND is not followed by a Close event within 2 minutes. Is this possible? If so, how would I set this up? I'm assuming it would be a rolling window alert?</P> Fri, 31 Oct 2014 19:39:10 GMT jhollis 2014-10-31T19:39:10Z https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-for-when-a-given-event-is-NOT-followed/m-p/178359#M2988 <P>I've searched through this site and on Google, but can't find an answer to this. Here is the scenario: I have a physical security system that monitors door states (opened or closed). When a door is opened, an Open event is sent to Splunk from this system. When the door closes, a Close event is sent to Splunk. I want to design an alert in Splunk that will trigger if an Open event is received, AND is not followed by a Close event within 2 minutes. Is this possible? If so, how would I set this up? I'm assuming it would be a rolling window alert?</P> Fri, 31 Oct 2014 19:39:10 GMT https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-for-when-a-given-event-is-NOT-followed/m-p/178359#M2988 jhollis 2014-10-31T19:39:10Z https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-for-when-a-given-event-is-NOT-followed/m-p/178360#M2989 <P>YOu can utilize Splunk's transaction command with maxspan option for this. See more information below</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Transaction">http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Transaction</A></P> <P><A href="http://answers.splunk.com/answers/518/does-combining-startswith-and-maxspan-in-a-transaction-work.html">http://answers.splunk.com/answers/518/does-combining-startswith-and-maxspan-in-a-transaction-work.html</A></P> Fri, 31 Oct 2014 19:42:31 GMT https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-for-when-a-given-event-is-NOT-followed/m-p/178360#M2989 somesoni2 2014-10-31T19:42:31Z https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-for-when-a-given-event-is-NOT-followed/m-p/178361#M2990 <P>Thank you, Somesoni2! That looks like what I'm trying to do.</P> Fri, 31 Oct 2014 19:52:21 GMT https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-for-when-a-given-event-is-NOT-followed/m-p/178361#M2990 jhollis 2014-10-31T19:52:21Z