How to set up Alert setting, in case of a large interval between messages?

[metylkinandrey]

Good afternoon!
I receive messages from systems on splunk, several messages from one system line up in a message chain.
As a rule, six messages from one system line up in a chain of six messages.
By message chain, I mean that splunk receives six messages with the same field: "srcMsgId".
Messages arrive one after another at different intervals, but the interval should not exceed the value of N.

Tell me how can I set up Alert in splunk, in case the interval between messages in the chain exceeds the value N.

[isoutamo]

Hi

You could use streamstats to calculate duration/range between those events. See https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Streamstats

If that exceed the N then just alarm.

r. Ismo