Hi All, I am rather hoping someone can assist me in creating a search that can be used for an alert to detect when a connection to MQ fails to re-connect for a system I am supporting. I am new to Splunk and although I have found posts related to this topic, I have so far not been able to adapt them for my particular scenario. I was hopeful the search below would suffice, but then realised it only works as I wanted it to if the MQ connection actually drops, otherwise the count evaluates as 0 and I end up with a false alerts.   index="sepa_instant" source="D:\\Apps\\Instant_Sepa_01\\log\\ContinuityRequester*" | transaction startswith="connection_down_error raised" maxspan=4m | search "-INFOS- {3} QM reconnected" | stats count | where count="0" Any assistance provided would be very much appreciated.   ... View more