If found result wait 15 minutes and search for other result, alarm if not found

[Gord1020]

Hi All,

I'm trying to figure out a way to setup a splunk alert to do the following...

When the string "GFX_On" is found in our log there should always be a "GFX_Off" string found no longer than 15 minutes after.

We want splunk to alarm if it doesn't find the "GFX_Off" within 15 minutes of the last "GFX_On" it saw.

Basically this is a system that fires Graphics on and off on a video production system. We want to get alerted if the "GFX_Off" command doesn't fire into our logs within 15 minutes.

Hope this makes sense. Would really appreciate any help as I'm not even sure where to start.

I think I would need to do an if statement of some kind in the search.

Thanks!

[richgalloway]

See if this helps.

```Read all GFX_On and GFX_Off events```
index=foo ("GFX_On" OR "GFX_Off")
```Keep the most recent event```
| head 1
```Check if it's an On event with a timestamp before 15 minutes ago```
| where (searchmatch("GFX_On") AND _time < relative_time(now(), "-15m"))