https://community.splunk.com/t5/Getting-Data-In/Create-an-event-for-user-login-to-VPN-and-the-network/m-p/351817#M64514 <P>If you can post non-confidential samples of searches that return a LAN logon, and a VPN logon, we can get closer, but here's a version in pseudocode...</P> <PRE><CODE>( index=fooLAN sourcetype=LANsource "whatever other stuff that shows LAN logons") OR ( index=fooVPN sourcetype=VPNsource "whatever other stuff that shows VPN logons") | bin _time as mytime span=10m | eval userid=coalesce(LANUseridField,VPNUseridField) | eval mytype=if(sourcetype=LANsource,"LAN","VPN") | stats range(_time) as timerange, min(_time) as startTime, max(_time) as endTime values(mytype) as mytype by mytime userid | where (mvcount(mytype) &gt;1) </CODE></PRE> Thu, 27 Apr 2017 22:13:04 GMT DalJeanis 2017-04-27T22:13:04Z https://community.splunk.com/t5/Getting-Data-In/Create-an-event-for-user-login-to-VPN-and-the-network/m-p/351816#M64513 <P>I'm new at creating Splunk searches and events. I would like a Notable Event to alert whenever an employee login is detected on the network and the VPN at the same time. I read that this can be done with a sub-search, but I'm having trouble creating the search query. Any suggestions would be greatly appreciated. </P> Thu, 27 Apr 2017 13:39:25 GMT https://community.splunk.com/t5/Getting-Data-In/Create-an-event-for-user-login-to-VPN-and-the-network/m-p/351816#M64513 aschroeder 2017-04-27T13:39:25Z https://community.splunk.com/t5/Getting-Data-In/Create-an-event-for-user-login-to-VPN-and-the-network/m-p/351817#M64514 <P>If you can post non-confidential samples of searches that return a LAN logon, and a VPN logon, we can get closer, but here's a version in pseudocode...</P> <PRE><CODE>( index=fooLAN sourcetype=LANsource "whatever other stuff that shows LAN logons") OR ( index=fooVPN sourcetype=VPNsource "whatever other stuff that shows VPN logons") | bin _time as mytime span=10m | eval userid=coalesce(LANUseridField,VPNUseridField) | eval mytype=if(sourcetype=LANsource,"LAN","VPN") | stats range(_time) as timerange, min(_time) as startTime, max(_time) as endTime values(mytype) as mytype by mytime userid | where (mvcount(mytype) &gt;1) </CODE></PRE> Thu, 27 Apr 2017 22:13:04 GMT https://community.splunk.com/t5/Getting-Data-In/Create-an-event-for-user-login-to-VPN-and-the-network/m-p/351817#M64514 DalJeanis 2017-04-27T22:13:04Z