Alert creation

[jagssplunk123]

i wnat to generate an alert whenever one of the text string is missing between two in the same log file every 30 min . Please look into the below query for reference:

| union maxout=10 [ search index=72434_Taxi host=ah-1125888-001* "Finished Reading file for data Load: "] [search index=72434_Taxi host=ah-1125888-001* "Reading file for data Load:"]

I want an alert if any of the string is missing as per above query.

[richgalloway]

As I understand the question, you have two specific event texts and expect to see other text between them.  The alert is needed if that other text doesn't appear.

The existing query just locates the two boundary texts so it won't alert if the other text is missing.  Ideally, one would search for the Other text and alert if the result count is zero.  I'm assuming that can't be done for $reasons.

Try the transaction command.  There may be other ways to accomplish the job, but this is simple.  This query groups events between "Reading..." and "Finished..." events.  If the number of events in a group is only 2 then the Other text must be missing.

index=72434_Taxi host=ah-1125888-001* 
| transaction endswith="Finished Reading file for data Load: " startsswith="Reading file for data Load:"
| where eventcount = 2