How do I join results of two searches and trigger an alert where 2 events (one from each search) occur within a one minute time range?

[MikeBertelsen]

How do i join these two events where both are true for a one minute time range?

index=BOB "No response from remote server RegistryClient "

Returns two events on host server A:
1 A - 14:59:55
2 A - 16:00:15

index=BOB "getTestRegistry remote call to ping registry failed!"

Returns multiple events on one or more of these host servers L, M, N, & O as follows:

1 LM - 5:00:25
2 LMO - 13:10:15
3 NO - 13:50:11
4 L - 14:20:19
5 M - 15:01:05
6 MN - 16:11:00

The goal is to trigger an alert on (1 A - 14:59:55) and (5 M - 15:01:05 ) as they happened within one minute of each other. All other events do not matter.

[woodcock]

Take a look at this Q&A; you should be able to modify that solution to fit your needs:

https://answers.splunk.com/answers/232781/find-all-events-of-type-x-that-do-not-have-an-even.html

[MuS]

Hi MikeBertelsen,

in the two answers provided below you will get some ideas how this can be done. The first one will be about comparing events without join or append:

https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-jo...

the second one will use some eval on _time to get values from different times:

https://answers.splunk.com/answers/185829/how-to-create-a-custom-macro-function-inside-the-s.html

Also read this blog post about streamstats which will be helpful to you:

http://blogs.splunk.com/2013/10/31/streamstats-example/

Hope this helps ...

cheers, MuS

[sundareshr]

See if this sorta pseudo code gives you what you are looking for.

index=bob "No response" | eval src=1 | append [search index="bob" "getTestRegistry" | eval src=2] | sort _time | delta _time as t p=1 | delta p=1 src  | where src>0 AND t<1 minute

Hopefully, the streamstats & delta commands give you some ideas

[MikeBertelsen]

index=bob "No response from remote server RegistryClient " | eval src=1 | append [search index=bob "getTestRegistry remote call to ping registry failed!" | eval src=2] | sort _time | delta _time as t p=1 | delta p=1 src | where src>0 AND t<1

did not return the desired results as far as i can tell. but thanks.

[sundareshr]

what do you get when you remove the where clause?

[MikeBertelsen]

I get all the desired events in reverse order same as i would get with this syntax: index=bob "No response ..." OR "getTestRegistry..."

[sundareshr]

what are the values for src & t? Do those look right?