Hi There, I have two Application log messages that I receive in Splunk  1. Service stopped 2. Service Started I need to create an alert if the "service started" log message does not show up within 10 minutes of the "Service  stopped" log message. So the alert needs to trigger an email only if it has been more than 10 min since the service stopped an a new log message stating Service started does not show up in the logs. I am finding some solutions here, but need one that will compare the log messages, I am new to splunk please do share the syntax as I would not know how to work it out without it. index=* | search app=xxx log="xxx" message="*service stopped/started*" ... View more

So I want to create an alert if one of our server is not connected, but the server disconnects automatically for every 12 hours and reconnects again in a few minutes, so I only need an alert triggered if the server does not reconnect within 10minutes of it getting disconnected. *SourceName="AppLog" Message="service status *"* there are two logs that occur, one is service status started and service status stopped. I need the alert triggered only if the service status started log does not appear within 10min of service stopped log message ... View more