https://community.splunk.com/t5/Splunk-Enterprise-Security/Correaltion-Search-Detect-if-an-Acces-Apache-Log-exist-for-a/m-p/557590#M10023 <P>Hi <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/163730">@venkatasri</a> ,</P><P>Yes that's it ! It seems to work perfectly !<BR /><BR />Thank you so much for your help <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 29 Jun 2021 11:56:14 GMT yanisA 2021-06-29T11:56:14Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Correaltion-Search-Detect-if-an-Acces-Apache-Log-exist-for-a/m-p/557569#M10021 <P>Hello,</P><P>We need to develop a Correlation Search to implement this algorithm :</P><P>If a specific custom event (here tagged as index="custom_app" categorie="custom_log") occures for one user we trigger an alert if there is no access apache log for the same user.</P><P>I have tried the following correlation search with trigger conditions : Trigger alert when Number of Results is equal to 0.</P><P>index="linux_apache" sourcetype="apache:access:kv"</P><P>[search index="custom_app" categorie="custom_log"</P><P>| top limit=1 user</P><P>| table user]</P><P>| table user</P><P>| dedup user</P><P>&nbsp;</P><P>Thanks by advance for your help regarding this topic</P> Tue, 29 Jun 2021 08:59:42 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Correaltion-Search-Detect-if-an-Acces-Apache-Log-exist-for-a/m-p/557569#M10021 yanisA 2021-06-29T08:59:42Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Correaltion-Search-Detect-if-an-Acces-Apache-Log-exist-for-a/m-p/557576#M10022 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/235889">@yanisA</a>&nbsp;</P><P>As i understood you want to return top user to main search linux* and if there is a single table entry then you want to trigger it. You can try following query</P><P>&nbsp;</P><LI-CODE lang="markup">index="linux_apache" sourcetype="apache:access:kv" [search index="custom_app" categorie="custom_log" | top limit=1 user | return user] | stats count by user</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>---</P><P>An upvote would be appreciated and Accept solution if it helps!</P><P>&nbsp;</P> Tue, 29 Jun 2021 10:28:15 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Correaltion-Search-Detect-if-an-Acces-Apache-Log-exist-for-a/m-p/557576#M10022 venkatasri 2021-06-29T10:28:15Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Correaltion-Search-Detect-if-an-Acces-Apache-Log-exist-for-a/m-p/557590#M10023 <P>Hi <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/163730">@venkatasri</a> ,</P><P>Yes that's it ! It seems to work perfectly !<BR /><BR />Thank you so much for your help <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 29 Jun 2021 11:56:14 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Correaltion-Search-Detect-if-an-Acces-Apache-Log-exist-for-a/m-p/557590#M10023 yanisA 2021-06-29T11:56:14Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Correaltion-Search-Detect-if-an-Acces-Apache-Log-exist-for-a/m-p/557596#M10024 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/235889">@yanisA</a>&nbsp;Hope it helped, Appreciate if you could Accept solution.</P> Tue, 29 Jun 2021 13:02:22 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Correaltion-Search-Detect-if-an-Acces-Apache-Log-exist-for-a/m-p/557596#M10024 venkatasri 2021-06-29T13:02:22Z