| stats count
| eval source="/logs/Test1/error.log, /logs/Test1/systemout.log, /logs/Test2/error.log, /logs/Test2/systemout.log"
| makemv delim="," source
| mvexpand source
[ search ... whatever search you would use to find these transactions from these files that includes the source]
| stats sum(eval(if(isnull(_time),0,1))) as count by source
| where count < 1
Then set your alert to look back 10 minutes and trigger condition to Number of Results > 0