Like this.. This will convert your fields to epoch time, find the difference, then convert to hours/min/sec | eval time_epoch=strptime(time, "%m/%d/%y %H:%M:%S") | eval timenow_epoch=strptime(timenow, "%m/%d/%y %H:%M:%S") | eval diff=timenow_epoch-time_epoch | eval diff=strftime(diff, "%H:%M:%S") ... View more

Try this. You should test it out with rex first inline of your search to verify it works user-name\=\"(?<user>[a-z1-9]+) | rex user-name\=\"(?<user>[a-z1-9]+) ... View more

Yes, I've built this out for multiple companies while consulting and built it out for my current company. ITSI has a portion called "event analytics" which rolls up notable events into an episode. This makes it easier to tie dependent services together and create a single actionable alert. ITSI also helps visualize dependent services into a single service which makes it easier to see upstream processes which are negatively affecting the downstream service. There's also tons of ITSI talks from CONF you can check out to see their journey One other cool thing that ITSI is getting into is the predictive analytics. I presented on this 2 years ago which allows us to leverage the ITSI data and make predictions of service failure before it happens. ITSI gave us a faster time to value than doing it in core splunk ... View more