I've searched through this site and on Google, but can't find an answer to this. Here is the scenario: I have a physical security system that monitors door states (opened or closed). When a door is opened, an Open event is sent to Splunk from this system. When the door closes, a Close event is sent to Splunk. I want to design an alert in Splunk that will trigger if an Open event is received, AND is not followed by a Close event within 2 minutes. Is this possible? If so, how would I set this up? I'm assuming it would be a rolling window alert?
YOu can utilize Splunk's transaction command with maxspan option for this. See more information below
http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Transaction
Thank you, Somesoni2! That looks like what I'm trying to do.