how to see if event didnt occur after 15 min from other event

[ivana27]

Hi all,

i am new to Splunk and i need to create search which will show that event with end didnt occur after 15 min from start event. Please help me.

This is start event: [Information] Downtime start:16/12/2020 18:13:07.043

And this one shows end of below one: [Information] Downtime start:16/12/2020 18:13:07.043, end:17/12/2020 08:09:57.505

I would like check if duration from start event extended 15 min to occur end event.

Thank you very much

[richgalloway]

Since the start and end times are in one event, we just need to convert them to epoch form and then compare them.

index=foo "end:"
| rex "start: (?<startTime>[^,]+)"
| rex "end: (?<endTime>.*)"
| eval start=strptime(startTime, "%d/%m/%Y %H:%M:%S.%3N"), end=strptime(endTime, "%d/%m/%Y %H:%M:%S.%3N")
| eval diff = end - start
| where diff > 900

[ivana27]

Thank you for quick reply. Actually they are 2 different events. Trick is here that i need to predict if end event will not occur 15 min from start one, i can not wait to see when end will occur if duration lasts more then 15 min. Please if you have some hint i would really be grateful.