how to see if end event didnt occur after 15 min from other event

[ivana27]

Hi all,

i am new to Splunk and i need to create search which will show that event with end didnt occur after 15 min from start event. Please help me.

This is start event: [Information] Downtime start:16/12/2020 18:13:07.043

And this one shows end of below one: [Information] Downtime start:16/12/2020 18:13:07.043, end:17/12/2020 08:09:57.505

I would like check if duration from start event extended 15 min to occur end event.

Thank you very much

[ivana27]

Hi all,

i am new to Splunk and i need to create search which will show that event with end didnt occur after 15 min from start event. Please help me.

This is start event: [Information] Downtime start:16/12/2020 18:13:07.043

And this one shows end of below one: [Information] Downtime start:16/12/2020 18:13:07.043, end:17/12/2020 08:09:57.505

I would like check if duration from start event extended 15 min to occur end event.

Thank you very much

[to4kawa]

index=_internal | head 1 | fields _raw | eval _raw="[Information] Downtime start:16/12/2020 18:13:07.043, end:17/12/2020 08:09:57.505"
| rex "start:(?<start>.*), end:(?<end>.*)"
| eval start=strptime(start,"%d/%m/%Y %T.%3N"), end=strptime(end,"%d/%m/%Y %T.%3N")
| streamstats values(eval(end-start)) as duration window=1
| where duration > 15 * 60

[ivana27]

Thank you very much for quick respond. Problem here is that i can not wait for end event to notify alert, i need to calculate duration from start event and if end event doesnt show up after 15 min i should be notified. Its very tricky because i need to do prediction of end event.

[to4kawa]

please use addinfo  and make duration.

[ivana27]

Can you please give me some hint, i am really new in Splunk. Thank you

[to4kawa]

We make the SPL from the logs.
Since there is no log, SPL cannot be created.
Please look up the meaning of the command.

[ivana27]

I am using something like this to catch time of start event

| rex field=_raw "Downtime\sstart\:(?<dStart>\d{1,2}\/\d{1,2}\/\d{4}\s\d{1,2}\:\d{1,2}\:\d{1,2}\.\d{1,3})"
| rex field=_raw "end\:(?<dEnd>\d{1,2}\/\d{1,2}\/\d{4}\s\d{1,2}\:\d{1,2}\:\d{1,2}\.\d{1,3})"