Custom condition for creating a particular alert

[misteryuku]

Lets say I have Splunk that monitors a log file that contains two log messages that look like this :

Tue Mar 06 07:41:28 SGT 2012 no = 8 time = 30.614993 src = 10.1.1.1 dest = 129.111.30.27 protocol = IPv4 length = 70 info = "Fragmented IP protocol (proto=UDP 0x11, off=0, ID=00f2) "

Tue Mar 06 07:41:29 SGT 2012 no = 9 time = 30.615348 src = 10.1.1.1 dest = 129.111.30.27 protocol = UDP length = 38 info = "Source port: 31915 Destination port: 20197 [BAD UDP LENGTH 36 > IP PAYLOAD LENGTH] "

I would like to have the ALERT triggered in real time whenever Splunk detects these two messages that contains the same src field value same dest field value and info that contains this value "Fragmented IP protocol (proto=UDP 0x11, off=0, ID=00f2)" and info that contains "Source port: 31915 Destination port: 20197 [BAD UDP LENGTH 36 > IP PAYLOAD LENGTH] "

What would be the custom condition ?

[Ayn]

Use transaction and search for transactions that meet your criteria. Assuming your fields are called src and dest (change otherwise) and you're only interested if the two events occur within 5 seconds:

... | transaction maxspan=5s src dest | search "Fragmented IP protocol" AND "BAD UDP LENGTH"

Then just create an alert that triggers wherever this search yields a match.

NOTE that in search I didn't match on the complete strings you mentioned, because I imagine parameters like the source port, UDP ID, UDP length etc will vary.

[misteryuku]

okay. I understand

[Ayn]

That's what the transaction command does - it combines events that share the same values for src and dst.

[misteryuku]

I also need another citeria, the src field values and the dest field values are the same for the two log messages. How to combine the two citerias to the search expression that you stated above?