Our system logs an event when it receives a message (with a unique key) Some time later our system also logs an event when we are ready (same unique key) There are also messages in between. I want to be able to find which messages have already arrived, but for which we do not (yet) have a "ready" event . I now have this query index = <our index> ApplicationName = <our application> | sort DOCID | stats first (_time) as start last (_time) as end by DOCID And that gives a table with 3 columns, in which sometimes there is an equal value of start and end. But I now want a list of DOCIDs that do have a start event but no end event. ... View more

Good day,   I am new to Splunk and just have completed the fundamentals I course.   For my first use case I am looking for an example where I can create reports/dashboard on average time spent in our systems. I have a key (orderid) and multiple systems log events where they provide this orderid as field. In some systems the process continues after a human has acted. This might take hours or days.   I need to display stats like: average time to process an order end to end. But also the number of orders that have started but have not yet ended.   Thanks   Can you point me to a sample/documentation that will help me to achieve this ? ... View more