Splunk alert if no events in source returned in X time

[markgomez00]

Hi I was wondering if it is possible on splunk to search for a specific message on a source/log then alert if the last event received was more than 2 minute ago

my search string is:

  index=[index] host=[host] sourcetype=[sourcetype] "Keyword"

I'm searching for the word "Keyword" and i want to set an alert if the last result is more than 2 minutes ago

Thanks in advance

[richgalloway]

How about narrowing your search to the last 2 minutes and setting an alert if there are no results?

[markgomez00]

Hi @richgalloway thanks for your response,

I tried narrowing it to 2 minutes by adding 'earliest=-2m latest=now()' to my search, i have set it to run every 1 minute and if the result is 0 the alert should trigger, but sometimes the alert is triggering even if the results is > 0, is this a problem on timing?

note: the keyword is generated every 1 minute