https://community.splunk.com/t5/Splunk-Search/Hello-I-need-to-build-a-alert-that-fires-on-the-presents-of-the/m-p/358430#M164127 <P>it does thank you</P> Thu, 28 Dec 2017 18:12:00 GMT bluemarvel 2017-12-28T18:12:00Z https://community.splunk.com/t5/Splunk-Search/Hello-I-need-to-build-a-alert-that-fires-on-the-presents-of-the/m-p/358427#M164124 <P>In order for the alert to work, both Eventcodes have to be activated. </P> <P>query | search EventCode=4663 OR EventCode=4776 | table _time,EventCode,Message, </P> Thu, 28 Dec 2017 14:18:58 GMT https://community.splunk.com/t5/Splunk-Search/Hello-I-need-to-build-a-alert-that-fires-on-the-presents-of-the/m-p/358427#M164124 bluemarvel 2017-12-28T14:18:58Z https://community.splunk.com/t5/Splunk-Search/Hello-I-need-to-build-a-alert-that-fires-on-the-presents-of-the/m-p/358428#M164125 <P>Generally in windows logs for every event there will be one EventCode per event .</P> <P>unable to understand the criteria "For triggerring the alert both event codes have to be activated?"</P> <P>Per my understanding , does the alert needs to trigger if both the event codes occur with time difference ? </P> Thu, 28 Dec 2017 15:31:18 GMT https://community.splunk.com/t5/Splunk-Search/Hello-I-need-to-build-a-alert-that-fires-on-the-presents-of-the/m-p/358428#M164125 naidusadanala 2017-12-28T15:31:18Z https://community.splunk.com/t5/Splunk-Search/Hello-I-need-to-build-a-alert-that-fires-on-the-presents-of-the/m-p/358429#M164126 <P>I am making some assumptions:<BR /> 1.) you expect the events to happen on the same host, and in a specific order (4663 followed by 4776)<BR /> 2.) you expect the events to occur within a specified period of time (300 seconds)<BR /> 3.) you don't care about other events which may have occurred in the meantime.</P> <P>In which case the following should give you a result each time the above occurs:</P> <PRE><CODE>( EventCode=4663 OR EventCode=4776) | transaction host maxspan=300s startswith="EventCode=4663" endswith="EventCode=4776"|table _time,host,EventCode,Message </CODE></PRE> Thu, 28 Dec 2017 16:05:46 GMT https://community.splunk.com/t5/Splunk-Search/Hello-I-need-to-build-a-alert-that-fires-on-the-presents-of-the/m-p/358429#M164126 nickhills 2017-12-28T16:05:46Z https://community.splunk.com/t5/Splunk-Search/Hello-I-need-to-build-a-alert-that-fires-on-the-presents-of-the/m-p/358430#M164127 <P>it does thank you</P> Thu, 28 Dec 2017 18:12:00 GMT https://community.splunk.com/t5/Splunk-Search/Hello-I-need-to-build-a-alert-that-fires-on-the-presents-of-the/m-p/358430#M164127 bluemarvel 2017-12-28T18:12:00Z https://community.splunk.com/t5/Splunk-Search/Hello-I-need-to-build-a-alert-that-fires-on-the-presents-of-the/m-p/358431#M164128 <P>no, the suggestion that was provided will suffice, thank you </P> Thu, 28 Dec 2017 20:19:59 GMT https://community.splunk.com/t5/Splunk-Search/Hello-I-need-to-build-a-alert-that-fires-on-the-presents-of-the/m-p/358431#M164128 bluemarvel 2017-12-28T20:19:59Z