https://community.splunk.com/t5/Getting-Data-In/Help-needed-with-Search-to-correlate-Windows-Event-Logs/m-p/356579#M65146 <P>Try this!</P> <PRE><CODE>index=(your inddex) (EventCode= 4624 OR EventCode= 4672 EventCode= 4676) | bucket span=30s _time | stats dc(EventCode) as count by _time,hostname|where count=3 </CODE></PRE> Mon, 25 Sep 2017 12:13:15 GMT HiroshiSatoh 2017-09-25T12:13:15Z https://community.splunk.com/t5/Getting-Data-In/Help-needed-with-Search-to-correlate-Windows-Event-Logs/m-p/356578#M65145 <P>Hi All, </P> <P>I have a requirement to write a Splunk query that will alert if windows event logs capture three EventCodes (independent events) within 30 secs</P> <P>PseudoQuery : <BR /> "EventCode= X, Y, Z| bucket span=30s _time | fields _time hostname EventCode"</P> <P>Any leads, please?</P> Mon, 25 Sep 2017 11:59:37 GMT https://community.splunk.com/t5/Getting-Data-In/Help-needed-with-Search-to-correlate-Windows-Event-Logs/m-p/356578#M65145 rishiaggarwal 2017-09-25T11:59:37Z https://community.splunk.com/t5/Getting-Data-In/Help-needed-with-Search-to-correlate-Windows-Event-Logs/m-p/356579#M65146 <P>Try this!</P> <PRE><CODE>index=(your inddex) (EventCode= 4624 OR EventCode= 4672 EventCode= 4676) | bucket span=30s _time | stats dc(EventCode) as count by _time,hostname|where count=3 </CODE></PRE> Mon, 25 Sep 2017 12:13:15 GMT https://community.splunk.com/t5/Getting-Data-In/Help-needed-with-Search-to-correlate-Windows-Event-Logs/m-p/356579#M65146 HiroshiSatoh 2017-09-25T12:13:15Z