Goal: Being able to alert off the latest event if the event is more than 300 seconds and is not blank or "non-productive". Here is my current search and the results: Every incident is an...
See more...
Goal: Being able to alert off the latest event if the event is more than 300 seconds and is not blank or "non-productive". Here is my current search and the results: Every incident is an open or a closing of an event. If the incident is blank, that signifies a closing of the previous event. If the incident has a string, that is the current open event. In my ideal scenario, I would alert based on any incident where I have a string value within the incident field, current duration has surpassed 300 seconds, and I don't have a value in the total duration field. However, when I try to add a filter for | where total duration = "", no results are returned at all.. Which I am confused about since the latest totalduration event is blank since streamstats is false... Any help or tips greatly appreciated!