https://community.splunk.com/t5/Getting-Data-In/Tag-events-coming-from-two-sources-as-Potential-and-False/m-p/381530#M100226 <P>I have two sources of events say source_1 and source_2<BR /> Both the events are coming to splunk i need to check the id and Timestamp of the event and <BR /> if the event coming from both sources at around same time i have to tag it as "Potential" otherwise "False".</P> <P>The catch is if i get the event at say 3pm from source_1 then my rule should check for the same event from 2:55 to 3:05 for sourcetype_2.<BR /> If found tag it as "Potential" otherwise "False".</P> <P>Please help with this.</P> Tue, 29 Sep 2020 23:53:08 GMT veerendra_modi 2020-09-29T23:53:08Z https://community.splunk.com/t5/Getting-Data-In/Tag-events-coming-from-two-sources-as-Potential-and-False/m-p/381530#M100226 <P>I have two sources of events say source_1 and source_2<BR /> Both the events are coming to splunk i need to check the id and Timestamp of the event and <BR /> if the event coming from both sources at around same time i have to tag it as "Potential" otherwise "False".</P> <P>The catch is if i get the event at say 3pm from source_1 then my rule should check for the same event from 2:55 to 3:05 for sourcetype_2.<BR /> If found tag it as "Potential" otherwise "False".</P> <P>Please help with this.</P> Tue, 29 Sep 2020 23:53:08 GMT https://community.splunk.com/t5/Getting-Data-In/Tag-events-coming-from-two-sources-as-Potential-and-False/m-p/381530#M100226 veerendra_modi 2020-09-29T23:53:08Z