Correlation rule to check if an event not being received

[Anonymous]

Hello,

I am trying to create a rule to check within a time frame if we didnt receive an event matches certain criteria

is the below correct?

SELECT * FROM Event(isNotOneOfIgnoreCase(action,{ 'test' })).win:time(1 Minutes) GROUP BY action HAVING COUNT(*) = 0;

[Anonymous]

Anyone?

Is it possible to have alert without doing it in EPL?