How to configure an alert to trigger when two logs from two different sources are received?

[karan_gopani]

Hello Everyone,

I am new to Splunk and I want to configure an Alert which should trigger when two different logs are received from two different Sources.

For Ex. When
1. Log of Firewall comes with SADDR=8.8.8.8 with deviceAction Allowed
2. Log of WAF comes with SADDR=8.8.8.8 with deviceAction Blocked.

Here the Alert should trigger when both SADDR is allowed on firewall and Blocked on WAF.

Thanks

[sundareshr · Accepted solution]

Try this. Set your alert if count > 0

(sourcetype=FirewallLogs deviceAction="Allowed") OR (sourcetype=WASLogs deviceAction="Blocked") | stats dc(sourcetype) as count by SADDR | where count=2