How to get alerts when event X isn't followed by event Y within a certain length of time?

[andrew_burnett]

I need an alert where you get this message "Attempting to send email to:<email>" but you don't ever get the message "Email sent successfully" within 1-2 minutes. The problem is if you don't get the second message, a restart will be required before you do. So I need event 1, but no event 2

[gcusello]

Hi @andrew_burnett,

you should try something like this:

index=your_index ("Attempting to send email to:" OR "Email sent successfully")
| eval message_kind=if(searchmatch("Attempting to send email to:"),"1","2")
| stats dc(message_kind) AS dc_message_kind values(message_kind) AS message_kind
| where dc_message_kind=1 AND message_kind="1"

Ciao.

Giuseppe

[andrew_burnett]

My question about it is, when the "Attempting to send email to:" gets stuck, all the logs stop. Would that search work in this case?

[gcusello]

Hi @andrew_burnett,

as you asked the above search takes logs and check if the first message is followed by the second, the alert triggers when the first message isn't followed by the second (the where condition).

Ciao.

Giuseppe