As I understand the question, you have two specific event texts and expect to see other text between them.  The alert is needed if that other text doesn't appear. The existing query just locates the two boundary texts so it won't alert if the other text is missing.  Ideally, one would search for the Other text and alert if the result count is zero.  I'm assuming that can't be done for $reasons. Try the transaction command.  There may be other ways to accomplish the job, but this is simple.  This query groups events between "Reading..." and "Finished..." events.  If the number of events in a group is only 2 then the Other text must be missing. index=72434_Taxi host=ah-1125888-001* | transaction endswith="Finished Reading file for data Load: " startsswith="Reading file for data Load:" | where eventcount = 2   ... View more