https://community.splunk.com/t5/Splunk-Search/correlate-two-seperate-searchs/m-p/166559#M47419 <P>How about this</P> <PRE><CODE>sourcetype=Entry OR sourcetype=Exit | transaction Employee,Door | where duration&lt;300 AND mvcount(Shirt)&gt;1 </CODE></PRE> Thu, 15 May 2014 21:03:33 GMT somesoni2 2014-05-15T21:03:33Z https://community.splunk.com/t5/Splunk-Search/correlate-two-seperate-searchs/m-p/166558#M47418 <P>What is the most efficient way to correlate results from two separate searches? I can perform two searches, but only want to see the end results when they meet very specific criteria applied to both original search results. </P> <P>For example:</P> <P>Search 1: [Sourcetype = Enter]</P> <P>Returns results like this:<BR /><BR /> Sourcetype = Enter<BR /><BR /> Time = 11:05AM<BR /><BR /> Employee = Sara<BR /><BR /> Door = West#3<BR /><BR /> Shirt = Red </P> <P>Search 2: [Sourcetype = Exit]</P> <P>Returns results like this:<BR /><BR /> Sourcetype = Exit<BR /><BR /> Time = 11:08AM<BR /><BR /> Employee = Sara<BR /><BR /> Door = West#3<BR /><BR /> Shirt = Blue </P> <P>I am only interested in the specific situation where someone enters and leaves through the same door, within 5 minutes, and is wearing a different shirt (the events above).</P> <P>I am not even sure the best approach in general to take here. </P> <P>Any help is appreciated. </P> <P>Thanks. </P> Thu, 15 May 2014 20:00:34 GMT https://community.splunk.com/t5/Splunk-Search/correlate-two-seperate-searchs/m-p/166558#M47418 JWBailey 2014-05-15T20:00:34Z https://community.splunk.com/t5/Splunk-Search/correlate-two-seperate-searchs/m-p/166559#M47419 <P>How about this</P> <PRE><CODE>sourcetype=Entry OR sourcetype=Exit | transaction Employee,Door | where duration&lt;300 AND mvcount(Shirt)&gt;1 </CODE></PRE> Thu, 15 May 2014 21:03:33 GMT https://community.splunk.com/t5/Splunk-Search/correlate-two-seperate-searchs/m-p/166559#M47419 somesoni2 2014-05-15T21:03:33Z