topic Search help please in Alerting

Search help please

csatech245 — Thu, 15 Jul 2021 19:02:43 GMT

Hello! I'm trying to set an alert that let's me know if tasks in a specific queue pass a specific duration. The search has been giving me issues. I tried a transaction line, but I don't have a endswith. Does anyone know how to run a search like this?

I'm trying something like:

earliest=-30d@d index=[DATA] sourcetype=incident_history incident_type=[SPECIFIC QUEUE] event_type=[SPECIFIC ACTION (LIKE A TASK ON HOLD)]
| transaction incident_id when startswith=[SPECIFIC ACTION (LIKE A TASK ON HOLD)] endswith= > 72h
| table incident_id, duration
| sort - duration

It's not a transaction, but the only thing I could thing of. What would be a search command forwhen an incident_id has been in a specific queue past a specific duration?

Any help would be appreciated.

Re: Search help please

ITWhisperer — Thu, 15 Jul 2021 20:18:29 GMT

Can you share some sample anonymised events? Also, detailing which fields you already have extracted?

Re: Search help please

csatech245 — Thu, 15 Jul 2021 21:40:12 GMT

I apologize, I'm not sure what you're asking for. Thank you for reaching out to a Splunk noob and offering assistance.

Re: Search help please

venkatasri — Fri, 16 Jul 2021 00:39:41 GMT

Hi @csatech245

This first query gives you the duration_in_seconds

earliest=-30d@d latest=now index=[DATA] sourcetype=incident_history incident_type=[SPECIFIC QUEUE] event_type=[SPECIFIC ACTION (LIKE A TASK ON HOLD)] | stats range(_time) as duration_in_seconds by incident_id

second query which provides all queues and respective time for each incident_id. Assumed your incident_type is having your queue details.

earliest=-30d@d latest=now index=[DATA] sourcetype=incident_history event_type=[SPECIFIC ACTION (LIKE A TASK ON HOLD)] | stats range(_time) as duration_in_seconds by incident_id, incident_type

---

An upvote would be appreciated and Accept solution if this reply helps!

Re: Search help please

csatech245 — Fri, 16 Jul 2021 12:49:35 GMT

Thank you very much! Your second example works perfect for every incident_id of all queues... this is even better. I appreciate your help!