How to set up an alert to trigger if EventB from IndexB happens within 1 minute after EventA from IndexA?

[dpanych]

I had a previous thread open, but since then I worked on the alert and refined some criteria. The alert is running off two indexes: ABC and windows (print logs). Basically what I want is, when the specific event from ABC happens AND right after (but no longer than 1 minute after) when the user prints the document “getContent.pdf,” I want it to alert. I got as far as joining the two logs together with the user field, but I am having trouble with the criteria, ONLY when the user prints the document after the specified ABC event, and I was also having trouble grouping by user.

See the screenshot below for example. The ABC event happens at 3:51:25 pm by user J0845, and soon after at 3:51:34pm the user prints getContent.pdf. That’s when I want it to alert.

Search:

(index=ABC Screen="DocDetl" Func="ViewImg" FileName="Your Number" UsrID=J0845) OR (sourcetype=WinPrintMon type=PrintJob user=J0845 "getContent.pdf")

[dpanych · Accepted solution]

Got it to work! Firstly, I had to create a field alias on the UsrID field (as user).

(index=ABC Screen="1" Function="2" Action="3" FileName="BLAH" UsrID=*) OR (sourcetype=WinPrintMon type=PrintJob user=* document="getContent.pdf")
| transaction user startswith=(FileName="BLAH") endswith=(*"getContent.pdf"*) maxspan=1m

[jkat54]

Please just edit your existing question(s) instead of opening new questions.

This is remarkably similar to your other question: https://answers.splunk.com/answers/400912/how-do-i-join-on-fields-from-two-different-sources.html

and about 2-3 other questions you posted. This behavior makes me want to skip your questions.