So if you intend to run the query once every 60 minutes and then look for an orderId with no success after 10 minutes, then the search has to be a little bit different. For example, if you look at 10 minute periods 9:00, 9:10, 9:20... and there is a start at 9:09 and a success at 9:14, you need to look at the whole event stream as a stream. Also, be aware that if you run the search at 10:00 am and there is a start at 9:59, but the success does not happen until 10:02, then you will not see the success in the search, but when you run the search at 11, you will not see the start, so you really need to run your search once every hour for 70 minutes. The search would then be something like this, using streamstats to look at all 10 minute windows your search
| streamstats time_window=10m dc(Status) as Statuses by OrderId
| stats max(Statuses) as Statuses by user
| where Statuses!=2 Your earliest and latest times would be earliest=-70m@m+1s
latest=@m So, this looks for -69m and 59 seconds to now, just to handle the sliding window across the schedule. Then it counts the unique values of Status for each OrderId - note, this assumes you only have a Start/Success pairing. It then finds out if you have 2 Statuses.
... View more
