I need to monitor all Windows servers to alert if there is a critical application got uninstalled. The simplest query would be searching for Event ID 11724 and compare the application name in "Message" field. index=wineventlog EventCode="11724"  | search Message="*app_name*"  However, it will get lots of false positive that application updates/upgrades will automatically uninstall the application (Event ID 11724) and install it (Event ID 11707) within 5 mins(average).     My idea is to combine 2 event ID in a single query. Searching for uninstallation event of an application and if there is no installation event (11707) can be found within 5 mins. It returns True for alerting. But I did a quick study on subsearch or join, and has no idea how to create this query. Anyone got a better idea?  ... View more