Splunk Search

How to set up an alert to trigger if EventB from IndexB happens within 1 minute after EventA from IndexA?

dpanych
Communicator

I had a previous thread open, but since then I worked on the alert and refined some criteria. The alert is running off two indexes: ABC and windows (print logs). Basically what I want is, when the specific event from ABC happens AND right after (but no longer than 1 minute after) when the user prints the document “getContent.pdf,” I want it to alert. I got as far as joining the two logs together with the user field, but I am having trouble with the criteria, ONLY when the user prints the document after the specified ABC event, and I was also having trouble grouping by user.

See the screenshot below for example. The ABC event happens at 3:51:25 pm by user J0845, and soon after at 3:51:34pm the user prints getContent.pdf. That’s when I want it to alert.

Search:

(index=ABC Screen="DocDetl" Func="ViewImg" FileName="Your Number" UsrID=J0845) OR (sourcetype=WinPrintMon type=PrintJob user=J0845 "getContent.pdf")

alt text

1 Solution

dpanych
Communicator

Got it to work! Firstly, I had to create a field alias on the UsrID field (as user).

(index=ABC Screen="1" Function="2" Action="3" FileName="BLAH" UsrID=*) OR (sourcetype=WinPrintMon type=PrintJob user=* document="getContent.pdf")
| transaction user startswith=(FileName="BLAH") endswith=(*"getContent.pdf"*) maxspan=1m

View solution in original post

0 Karma

dpanych
Communicator

Got it to work! Firstly, I had to create a field alias on the UsrID field (as user).

(index=ABC Screen="1" Function="2" Action="3" FileName="BLAH" UsrID=*) OR (sourcetype=WinPrintMon type=PrintJob user=* document="getContent.pdf")
| transaction user startswith=(FileName="BLAH") endswith=(*"getContent.pdf"*) maxspan=1m
0 Karma

jkat54
SplunkTrust
SplunkTrust

Please just edit your existing question(s) instead of opening new questions.

This is remarkably similar to your other question: https://answers.splunk.com/answers/400912/how-do-i-join-on-fields-from-two-different-sources.html

and about 2-3 other questions you posted. This behavior makes me want to skip your questions.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...