transaction event not updated in 20mins

[samtechy]

Hi,
I have a transaction ,begin and complete like below with session id.
Want to generate an alert if the event not updated in 20 mins. also want to skip the sessionids if the status is complete.
Please advise. Thanks.

Sessionid, Status ,time
s1,begin,00:00
s1,P1,00:40
.
.
s1,p15,08:00
s1,complete,09:00
s2,begin,10:00
s2,P1,10:40
.
.
s2,p15,18:30
s2, complete,19:45

[woodcock · Accepted solution]

Like this:

| makeresults 
| eval _raw="Sessionid,Status,time
s1,begin,00:00
s1,P1,00:40
s1,p15,08:00
s1,complete,09:00
s2,begin,10:00
s2,P1,10:40
s2,p15,18:30
s2,complete,19:45
s3,begin,23:24"
| multikv forceheader=1
| eval _time = strptime(time, "%H:%M")
| sort 0 - _time

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| search Status IN("begin", "complete")
| stats min(_time) AS _time range(_time) AS duration dc(Status) AS dc values(Status) AS Status BY Sessionid
| where dc==1 AND Status="begin"
| eval duration=if(duration>0, duration, (now() - _time))
| where duration > (20 * 60)

[samtechy]

thanks it worked.