I want to search for events that do not have a specific other event occurring within a certain time.
For example, I want to find all instances of EventCode=1
where there is no EventCode=2
within 5 minutes.
If you would like a specific answer you'll need to provide your SPL and examples of your events but in theory you could do that using a subsearch.
sourcetype=some_sourcetype NOT [search sourcetype=another_sourcetype | fields field_val]
https://docs.splunk.com/Documentation/Splunk/7.0.3/Search/Usesubsearchtocorrelateevents