I am new to Splunk. I have a file with below values. I have Indexed time as well. I need to write a query to alert for if any id has text=started and consequent 2 other texts ( it can be anything) for the same id in < 5 minutes.
123 in progress
456 in progress
index=test text="started" |stats count by id. But that is showing only the started ones and does not have the other texts . The other texts are random so cannot specify in a search.