Hello Everyone,
I am new to Splunk and I want to configure an Alert which should trigger when two different logs are received from two different Sources.
For Ex. When
1. Log of Firewall comes with SADDR=8.8.8.8 with deviceAction Allowed
2. Log of WAF comes with SADDR=8.8.8.8 with deviceAction Blocked.
Here the Alert should trigger when both SADDR is allowed on firewall and Blocked on WAF.
Thanks
Try this. Set your alert if count > 0
(sourcetype=FirewallLogs deviceAction="Allowed") OR (sourcetype=WASLogs deviceAction="Blocked") | stats dc(sourcetype) as count by SADDR | where count=2
Try this. Set your alert if count > 0
(sourcetype=FirewallLogs deviceAction="Allowed") OR (sourcetype=WASLogs deviceAction="Blocked") | stats dc(sourcetype) as count by SADDR | where count=2