Hi,
I have a transaction ,begin and complete like below with session id.
Want to generate an alert if the event not updated in 20 mins. also want to skip the sessionids if the status is complete.
Please advise. Thanks.
Sessionid, Status ,time
s1,begin,00:00
s1,P1,00:40
.
.
s1,p15,08:00
s1,complete,09:00
s2,begin,10:00
s2,P1,10:40
.
.
s2,p15,18:30
s2, complete,19:45
Like this:
| makeresults
| eval _raw="Sessionid,Status,time
s1,begin,00:00
s1,P1,00:40
s1,p15,08:00
s1,complete,09:00
s2,begin,10:00
s2,P1,10:40
s2,p15,18:30
s2,complete,19:45
s3,begin,23:24"
| multikv forceheader=1
| eval _time = strptime(time, "%H:%M")
| sort 0 - _time
| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"
| search Status IN("begin", "complete")
| stats min(_time) AS _time range(_time) AS duration dc(Status) AS dc values(Status) AS Status BY Sessionid
| where dc==1 AND Status="begin"
| eval duration=if(duration>0, duration, (now() - _time))
| where duration > (20 * 60)
Like this:
| makeresults
| eval _raw="Sessionid,Status,time
s1,begin,00:00
s1,P1,00:40
s1,p15,08:00
s1,complete,09:00
s2,begin,10:00
s2,P1,10:40
s2,p15,18:30
s2,complete,19:45
s3,begin,23:24"
| multikv forceheader=1
| eval _time = strptime(time, "%H:%M")
| sort 0 - _time
| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"
| search Status IN("begin", "complete")
| stats min(_time) AS _time range(_time) AS duration dc(Status) AS dc values(Status) AS Status BY Sessionid
| where dc==1 AND Status="begin"
| eval duration=if(duration>0, duration, (now() - _time))
| where duration > (20 * 60)
thanks it worked.