So I have got it working 99%
I did something like this
Index=xxxxxx "Starting iteration" OR "Stopping iteration"
| stats earliest(_time) as Start,latest(_time) as Stopped
| eval Taken=tostring(Stopped-Start)
| eval Taken=Taken/60
| eval Time_Taken=(if(Taken>15,"Not Good","Good"))
| where Time_Taken="Not Good"
| table Start Stopper Time_Taken
Now it shows Not Good if over 15 mins
The issue is how to set the alert properly - as if I set to check every 15 mins - it may overlap 2 starts - Example Started at 7pm and finished at 7.08pm Alert checks at like 7.25pm for the last 15 mins and it sees 7.08pm at Stopped then 7.15pm Start and maybe finished at 7.24pm - If that make sense to you guru's
... View more