Alert Based Off Current Event Duration

[NewToSplunk1]

Goal: Being able to alert off the latest event if the event is more than 300 seconds and is not blank or "non-productive".

Here is my current search and the results: 

NewToSplunk1_0-1694011225839.png

NewToSplunk1_2-1694012082568.png

Every incident is an open or a closing of an event. If the incident is blank, that signifies a closing of the previous event. If the incident has a string, that is the current open event. 

In my ideal scenario, I would alert based on any incident where I have a string value within the incident field, current duration has surpassed 300 seconds, and I don't have a value in the total duration field. 

However, when I try to add a filter for | where total duration = "", no results are returned at all.. Which I am confused about since the latest totalduration event is blank since streamstats is false...

Any help or tips greatly appreciated!

[NewToSplunk1]

Thank you!!

[NewToSplunk1]

| where TotalDuration = null returns no results as well.

[ITWhisperer · Accepted solution]

Try this

| where isnull(TotalDuration)