How to configure an alert for when a given event is NOT followed by another event within 2 minutes?

[jhollis]

I've searched through this site and on Google, but can't find an answer to this. Here is the scenario: I have a physical security system that monitors door states (opened or closed). When a door is opened, an Open event is sent to Splunk from this system. When the door closes, a Close event is sent to Splunk. I want to design an alert in Splunk that will trigger if an Open event is received, AND is not followed by a Close event within 2 minutes. Is this possible? If so, how would I set this up? I'm assuming it would be a rolling window alert?

[somesoni2]

YOu can utilize Splunk's transaction command with maxspan option for this. See more information below

http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Transaction

http://answers.splunk.com/answers/518/does-combining-startswith-and-maxspan-in-a-transaction-work.ht...

[jhollis]

Thank you, Somesoni2! That looks like what I'm trying to do.