https://community.splunk.com/t5/Splunk-Search/Alert-Based-Off-Current-Event-Duration/m-p/656860#M226872 <P>Thank you!!</P> Wed, 06 Sep 2023 15:22:51 GMT NewToSplunk1 2023-09-06T15:22:51Z https://community.splunk.com/t5/Splunk-Search/Alert-Based-Off-Current-Event-Duration/m-p/656854#M226869 <P>Goal: Being able to alert off the latest event if the event is more than 300 seconds and is not blank or "non-productive".<BR /><BR />Here is my current search and the results:&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="NewToSplunk1_0-1694011225839.png" style="width: 673px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/27075i529C7E68A22284DC/image-dimensions/673x244?v=v2" width="673" height="244" role="button" title="NewToSplunk1_0-1694011225839.png" alt="NewToSplunk1_0-1694011225839.png" /></span></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="NewToSplunk1_2-1694012082568.png" style="width: 672px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/27077iD31A7D85840B3FC7/image-dimensions/672x79?v=v2" width="672" height="79" role="button" title="NewToSplunk1_2-1694012082568.png" alt="NewToSplunk1_2-1694012082568.png" /></span></P><P>Every incident is an open or a closing of an event. If the incident is blank, that signifies a closing of the previous event. If the incident has a string, that is the current open event.&nbsp;</P><P>In my ideal scenario, I would alert based on any incident where I have a string value within the incident field, current duration has surpassed 300 seconds, and I don't have a value in the total duration field.&nbsp;</P><P>However, when I try to add a filter for | where total duration = "", no results are returned at all.. Which I am confused about since the latest totalduration event is blank since streamstats is false...</P><P>Any help or tips greatly appreciated!</P> Wed, 06 Sep 2023 14:57:41 GMT https://community.splunk.com/t5/Splunk-Search/Alert-Based-Off-Current-Event-Duration/m-p/656854#M226869 NewToSplunk1 2023-09-06T14:57:41Z https://community.splunk.com/t5/Splunk-Search/Alert-Based-Off-Current-Event-Duration/m-p/656857#M226870 <P>| where TotalDuration = null returns no results as well.</P> Wed, 06 Sep 2023 15:04:24 GMT https://community.splunk.com/t5/Splunk-Search/Alert-Based-Off-Current-Event-Duration/m-p/656857#M226870 NewToSplunk1 2023-09-06T15:04:24Z https://community.splunk.com/t5/Splunk-Search/Alert-Based-Off-Current-Event-Duration/m-p/656859#M226871 <P>Try this</P><LI-CODE lang="markup">| where isnull(TotalDuration)</LI-CODE> Wed, 06 Sep 2023 15:19:09 GMT https://community.splunk.com/t5/Splunk-Search/Alert-Based-Off-Current-Event-Duration/m-p/656859#M226871 ITWhisperer 2023-09-06T15:19:09Z https://community.splunk.com/t5/Splunk-Search/Alert-Based-Off-Current-Event-Duration/m-p/656860#M226872 <P>Thank you!!</P> Wed, 06 Sep 2023 15:22:51 GMT https://community.splunk.com/t5/Splunk-Search/Alert-Based-Off-Current-Event-Duration/m-p/656860#M226872 NewToSplunk1 2023-09-06T15:22:51Z