I have a events log something like this,
2018-06-29 03:34:23.090 -5 Thread-55 CM 6107 1 Content Manager is unable to process the request.
2018-06-29 03:39:23.090 -5 Thread-85 CM 6186 1 Event Solution Assigned URL http://*";
If this keyword1 occurred "Content Manager is unable to process the request" ,then I want to search for this keyword2 " Event Solution Assigned URL http://*"; within 10 minutes. if keyword2 not occurred within 10 minutes I want to send an alert
Like this:
Your Search For both Events Here
| reverse
| streamstats count(eval(searchmatch("Content Manager"))) AS sessionID
| eventstats first(_time) AS start_time BY sessionID
| eval secondsaway = _time - start_time
| where secondsaway < (10 * 60)