What Splunk query monitors for an expected event?

[Oerstier]

A microservice converts incoming records (logged as events) and must perform this conversion within 5 minutes. The output is also logged as an event for each successful conversion. I want to write a Splunk query that monitors all incoming records have an output event within this time limit. What Splunk query can monitor this? The recordID is logged in Splunk for both events under normal circumstances.

[richgalloway]

Search for the incoming and output events and then have Splunk match them up by recordID. This query looks for 2 events with the same recordID that are more than 5 minutes apart or a single event that arrived more than 5 minutes ago.

<your search for the events> | stats range(_time) as duration, count,, latest(_time) as recent by recordID | where (count==2 AND duration > 300) OR (count==1 AND recent < relative_time(now(), "-5m")

[inventsekar]

I assume, your app logs the event to a log file, you monitor ingested that log file to splunk. If yes, then you can write a query to see if the file gets updated every 5 mins.
Is this above assumption are correct, if not, update us more info. Thanks