i want a splunk query for alert , if a event takes more than 30 minutes of time , the alert will trigger, please anyone can guide ?

[shubham1234]

In splunk , as one production server many event are occurring everyday so i need a query for splunk to know if any event is taking more than 30 minutes of time, i need a alert for those type of event.

Thank You

[woodcock]

You can do something like this:

| tstats avg(_indextime) AS avg_indextime max(_indextime) AS max_indextime WHERE index=* BY sourcetype host _time
| stats avg(avg_indextime) AS avg_indextime max(max_indextime) AS max_indextime BY sourcetype host
| where ((avg_indextime > 30*60) OR (max_indextime > 30*60))

[kmorris_splunk]

So, when you say an event is taking more than 30 minutes, does that mean you have multiple events with the same Subscriber Number or some other unique ID. And I'm assuming there is an event that indicates completion of something (start and stop for example)?

[Vijeta]

@shubham1234 What is the timestamp for events? You can take the difference of index time and subtract it from _time to know if the difference is 30 min or more.

[shubham1234]

@Vijeta - i can take the index time , but many request are coming , for example one event is started at 9.00 a.m with one subscriber number and another same event start at 9.30 a.m , but the difference is , this time onother event start with different subscriberNumber( it is a number which is provided to person as a kind of validity) . so if i will use timeStamp , will it work ?

Thank you