Search that alerts if one event exists and another does not

[hcannon]

I have two types of events in the same index:

2016-10-27 00:43:49.722 event=file_change
2016-10-27 00:43:54.000 event=git_commit

I need to alert specifically when event=git_commit does NOT occur within 5 minutes of event=file_change

It seems that there are a few ways to go about this, using join or append or transaction - but given that my end goal is just an alert that one event exists without the other, I'm not sure which is the best search command to go with, given that I need a "if this and NOT that, alert". Any suggestions welcome!

[somesoni2]

Give this a try

your base search | transaction startswith=event="file_change" endswith=event="git_commit" | where duration>300

[cmerriman · Accepted solution]

I'd use transaction

...|transaction event startswith="file_change" max_span=5m|search eventcount=1

that should give you any transaction that only has a file_change with no git_commit within 5 minutes.