I'm would like to construct a search of our phone logs that provides a report indicating when a person calls someone back shortly after a call ends.
Time_Start, Time_End, Source_Number, Dest_Number
10:10, 10:20, 555-1212,555-1313
10:22, 10:30, 555-1212,555-1313
In the example data above, I'd like to increment a field called "callbacks" for the source field. The criteria for incrementing the callbacks field would be if the source number calls the destination number within 2 minutes of the call ending. If the source number calls a different number, that shouldn't be added to callbacks. I've written a lot of splunk searches, but this is beyond me.. Any guidance would be appreciated.