How to search and alert if a particular event is not seen within 10 minutes after the previous one?

[thippeshaj]

Hi All

Need your help in writing the search....

In my log, every 10 min I'll get a message like this:

ProcessStartDateTime: 07/12/2015 13:56:02
ProcessEndDateTime: 07/12/2015 13:59:36 

It means process has started and ended, so in the next 10 min's, I should get one more message like that. Sometimes we don't get that message, so it means the next process is not started. If I don't see that message within 10 min, I need to receive an alert. Please help me with writing a search for this.

[richgalloway]

Search for "ProcessStartDateTime". Schedule the search with cron schedule 0/10 * * * * to get it to run every 10 minutes. Set the Alert condition to "if number of events", "is equal to", and "0". Check the Enable box under "Send email" and fill in the appropriate boxes. Click Save and you'll get an email whenever the search doesn't find an event with "ProcessStartDateTime" in it. It's not pretty, but it will work.