to set an alert if event B doesn't happen post happening of event A

[trackvk]

I would like to set up an alert when a HeartBeat MISSED event happens in a log file but HeartBeat REACQUIRED event doesn't happen max within 1min span indicating an issue.

so wanted my search to alert i tried

...|rex "HEARTBEAT\s+(?\S+).*?(?MISSED|REACQUIRED)" | stats latest(_time) AS time latest(action) AS action BY hb | eval age=now()-time | where age>(1*60) AND action=MISSED

[richgalloway]

Perhaps this will help. It uses dedup to find the most recent action for each hb then keeps only the MISSED actions. Finally, only events older than a minute are kept.

... | rex "HEARTBEAT\s+\S+.*?(?<action>MISSED|REAQUIRED)" 
| dedup hb
| where action="MISSED"
| eval age = now() - _time
| where age > 60