Is it possible to create an alert only if a certain condition is not met?

[santosh1]

So I want to create an alert if one of our server is not connected, but the server disconnects automatically for every 12 hours and reconnects again in a few minutes, so I only need an alert triggered if the server does not reconnect within 10minutes of it getting disconnected.

*SourceName="AppLog" Message="service status *"*

there are two logs that occur, one is service status started and service status stopped. I need the alert triggered only if the service status started log does not appear within 10min of service stopped log message

[ITWhisperer]

Create a report that looks back over the previous 15 minutes for started and stopped messages, find the time of the latest message, and if the latest message is stopped and more than 10 minutes ago, keep the event. If you schedule the report to run every minute or at worst every 5 minutes, you should be able to capture when the server has not started in time

[santosh1]

Could you possibly show it to me as an example syntax I can use. I am new the Splunk Search Syntax