Splunk Search

Alert Based Off Current Event Duration

NewToSplunk1
Explorer

Goal: Being able to alert off the latest event if the event is more than 300 seconds and is not blank or "non-productive".

Here is my current search and the results: 

NewToSplunk1_0-1694011225839.png

NewToSplunk1_2-1694012082568.png

Every incident is an open or a closing of an event. If the incident is blank, that signifies a closing of the previous event. If the incident has a string, that is the current open event. 

In my ideal scenario, I would alert based on any incident where I have a string value within the incident field, current duration has surpassed 300 seconds, and I don't have a value in the total duration field. 

However, when I try to add a filter for | where total duration = "", no results are returned at all.. Which I am confused about since the latest totalduration event is blank since streamstats is false...

Any help or tips greatly appreciated!

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| where isnull(TotalDuration)

View solution in original post

NewToSplunk1
Explorer

Thank you!!

0 Karma

NewToSplunk1
Explorer

| where TotalDuration = null returns no results as well.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| where isnull(TotalDuration)
Get Updates on the Splunk Community!

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

Enterprise Security Content Update (ESCU) | New Releases

In April, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...