This filter type is useful in situations where you would like to take an action when an event does not occur. A common use case for this is a successful backup job. Most backup software will write an event to the event log when it complete successfully. If this event is not present we know something has gone wrong.
The following filter will expect to match an event in the 8:00 AM hour everyday.
If the event does not occur, EventSentry will write the following event to the Application log.