What SPL to use to detect when two conditions happen with a time difference?

[adespino]

Hi, 

I have some antivirus events that shows anti-malware action failed. 

With this I am trying to create an spl to identify when anti-malware action failed on a host but also wait for the next 12 hours to see if that action has changed. If it has not change it should generate results, otherwise it should not. 

I know the last part could be done with an if but I am not sure how to do de time part.

Thanks for the help

[adespino]

Thank you @richgalloway 
I appreciate the help.

[richgalloway]

Search over the previous 12 hours and count the number of times the condition occurs for each host.  If the count is two or more then generate results.

<<your search for failed actions>> earliest=-12h
| stats count by host
| where count>=2