I have below requirement
Log info: 09.00PM Xyz event received for customernumber:1234
Log info: 09.05 PM abc event received for customernumber:1234
Loginfo :09.10PM pqr event received for customernumber:1234
Like that n number of customer number is there in the splunk log
I want to check ,whether all 3 event has been received for customernumber or not
For that I tried using AND operation
Like "xyz received for customernumber" AND "abc event received for customernumber" AND "PQR event received for customernumber|rex (I tried retrieve customernumber)
Which is not working .pls help with exact query
This question is nearly the same as one you asked at https://community.splunk.com/t5/Alerting/And-condition/m-p/670558#M15557 . Please show how you used the answers there to craft a query that solves this problem and how that query fails to meet expectations.
As stated in the referenced answer, the AND operator works only on a single event and cannot compare values among several events.