Hi All , i have configured alerts for the search below: index="ebs_red_0" host="dev-obiee-ux0*" source="/obiee_12c/app/oracle/product/12212/user_projects/domains/bi/nodemanager/nodemanager.log" "waiting for the process to die" Output : 8/3/21 9:38:11.000 AM dev-obiee-ux08 The server 'obips2' with process id 12714242 is no longer alive; waiting for the process to die. obips2 obiee:nodemanager:log Aug 3, 2021 5:38:11 AM EDT   but sometimes when my server process dies it restarts automatically within a 60 seconds which can be described as : index="ebs_red_0" host="dev-obiee-ux0*" source="/obiee_12c/app/oracle/product/12212/user_projects/domains/bi/nodemanager/nodemanager.log" "is running now" Output :  8/3/21 9:39:27.000 AM dev-obiee-ux08 The server 'obis2' is running now. obis2 obiee:nodemanager:log Aug 3, 2021 5:39:27 AM EDT   So i want to write the search query in a way so that i generate alert only if the server process dies and doesn't come up again within 120 seconds. the five fields used in the search are : _time, host ,Message ,OBIEE_Comp, sourcetype ,time   and to generate the alert the OBIEE_Comp needs to be same  ... View more