Splunk check for continuous change in event and send alert if it is same from some minutes

[sahil237888]

I want to get the alert based on below table.

_time A B C
11-09-18 9:05 10 8 8
11-09-18 9:06 8 4 4
11-09-18 9:07 5 9 0
11-09-18 9:08 0 7 0
11-09-18 9:09 0 5 0
11-09-18 9:10 0 1 0
11-09-18 9:11 0 0 0
11-09-18 9:12 5 0 9
11-09-18 9:13 7 0 4
11-09-18 9:14 9 0 5

I want to setup an alert for if any of these A or B or C have 0 for consecutive 5 minutes.
The alert should specify for which (A or B or C) there was 0 for continuous 5 minutes.