I have splunk query which runs every 5 minutes and alert if certain keyword is not logged in index in last 5 minutes. But whenever there are splunk event delays it causes false alert to trigger. Is there any way i can differentiate if keyword is really not logged or is it due to latency in events . I tried using (_indextime - _time) but this will only work once event is received.
