create alert for specific accound and monitor logs gap

[Splunk_rocks]

I want to monitor AWS logs sources with various account when ever logs stopped coming for particular sourcetype i need alert for specific  accounts i have tried some thing like this but its not picking right away so any suggested SPL will be apricated ( not sure we can use Tstat so it will be much faster )

index=aws sourcetype="aws:cloudtrail" aws_account_id IN(991650019 55140 5557 39495836 157634 xxxx9015763) | eval now=now() | eval time_since_last=round(((now-Latest)/60)/60,2) | stats latest(_time) as last_event_time, earliest(_time) as first_event_time count by sourcetype aws_account_id | eval time_gap = last_event_time - first_event_time | where time_gap > 4000 | table aws_account_id first_event_time last_event_time time_gap | convert ctime(last_event_time)

[ITWhisperer]

Splunk is not good at finding what isn't there - you have to tell Splunk (by creating an event in some way) what the expected data is and compare that to the actual data that is received. For example, you could have a lookup file of expected accounts, or in your case, since you seem to know which accounts you are interested in and there are only a few, you could use makeresults to generate corresponding events. You would then append this list to the list of accounts you are finding in the logs and discount those which are in the logs, leaving you just the accounts which aren't in the logs.