This looks like a transaction question.
You can use the transaction command
see http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction
mysearch source=applicationA OR source=applicationB
| rex "pseudo field extraction to extract the file name in a field names myfilename"
| transaction myfilename maxspan=3600 keeporphans=true
| table _time duration myfilename source closed_txn eventcount _raw
if you find a transaction with a beginning but without an end, it should be the ones you are looking for
look at the options keeporphans and maxspan to control the transaction duration. you also can use the options startswith and endswith to if the termination exists (look at the field closed_txn)
Of course, there is always a way to create a more efficient search using the "stats" command.
example :
mysearch source=applicationA OR source=applicationB
| rex "pseudo field extraction to extract the file name in a field names myfilename"
| stats min(_time) AS timeSTART max(_time) AS timeEND earliest(source) AS sourceSTART latest(source) As sourceEND count dc(source) AS distinctSources by myfilename
| eval _time=timeSTART
| eval duration=timeEND-timeSTART | eval isin2sources=if(distinctSources>1,"yes","no")
| eval durationmorethan30min=if(duration<60*30,"no","yes")
