evaluate time range in splunk event data and alert

[GEB]

Given an event log specification of:
"{DateTime} Times:
Online_1: CNCT_TM: {CNCT_TM}; LOG_TM: {LOG_TM}
Online_2: CNCT_TM: {CNCT_TM}; LOG_TM: {LOG_TM}
Offline_1: CNCT_TM: {CNCT_TM}; LOG_TM: {LOG_TM}
Offline_2: CNCT_TM: {CNCT_TM}; LOG_TM: {LOG_TM}"

which is logged 4 times a day and an example entry like:
"2021-12-08 14:31:59 Times: Online_1: CNCT_TM: 2021-12-08 14:47:13.873; LOG_TM: 2021-12-08 14:47:16.387; Online_2: CNCT_TM: 2021-12-08 14:47:49.837; LOG_TM: 2021-12-08 14:47:50.480; Offline_1: CNCT_TM: 2021-12-08 14:48:27.303; LOG_TM: 2021-12-08 14:48:28.927; Offline_2: CNCT_TM: 2021-12-08 14:48:56.673; LOG_TM: 2021-12-08 14:48:58.750"

How do I evaluate and graph the time range in Minutes and Seconds (just seconds would be fine for me) between the maximum and minimum times embedded in the 8 times captured in the log entry?  Ultimately, I would like to create an alert if a time range greater than something like 30 minutes were to occur.

[GEB]

Sending thanks to ITWhisperer

[ITWhisperer · Accepted solution]

| makeresults
| eval _raw="2021-12-08 14:31:59 Times: Online_1: CNCT_TM: 2021-12-08 14:47:13.873; LOG_TM: 2021-12-08 14:47:16.387; Online_2: CNCT_TM: 2021-12-08 14:47:49.837; LOG_TM: 2021-12-08 14:47:50.480; Offline_1: CNCT_TM: 2021-12-08 14:48:27.303; LOG_TM: 2021-12-08 14:48:28.927; Offline_2: CNCT_TM: 2021-12-08 14:48:56.673; LOG_TM: 2021-12-08 14:48:58.750"



| rex max_match=0 "_TM:\s(?<timestamp>[^;]+)"
| eval timestamp=mvmap(timestamp,strptime(timestamp,"%Y-%m-%d %H:%M:%S.%Q"))
| eval earliest=mvindex(mvsort(timestamp),0)
| eval latest=mvindex(mvsort(timestamp),-1)
| eval timespan=latest-earliest