Goal: Being able to alert off the latest event if the event is more than 300 seconds and is not blank or "non-productive".
Here is my current search and the results:
Every incident is an open or a closing of an event. If the incident is blank, that signifies a closing of the previous event. If the incident has a string, that is the current open event.
In my ideal scenario, I would alert based on any incident where I have a string value within the incident field, current duration has surpassed 300 seconds, and I don't have a value in the total duration field.
However, when I try to add a filter for | where total duration = "", no results are returned at all.. Which I am confused about since the latest totalduration event is blank since streamstats is false...
Any help or tips greatly appreciated!
