alert based on data on previous and new event

[vadud3]

Apr 25 17:13:28 www2 sshd[27718]: [ID 800047 auth.debug] debug1: no match: WinSCP_release_4.3.2

[..within 5 secs..]

Apr 25 17:13:29 www2 sshd[27718]: [ID 800047 auth.info] Failed none for john from 10.2.43.186 port 1358 ssh2

So if winscp is below 4.0.4 get an alert saying john is using older release. Because that is
sshd2 process 27718 belongs to john.

How do I correlate between two events, 5+ secs apart, based on the process id and then generate an appropriate alert if a the number portion of the string is below 4.0.4?

Alert will always go to sysadmin@example.com.

[vadud3]

looks like this gave me what I wanted..

source="sshd.log" | rex field=raw "sshd[(?\d+)]: " | transaction pid maxspan=60s | search winscp | rex field=_raw "version WinSCP_release(?\d).(?\d).(?\d)" | eval version=major_version.minor_version1.minor_version2 | where version < 423

any suggestion on how to improve it appreciated

[vadud3]

ok so I "improved" the search

source="sshd.log" | rex field=raw "sshd[(?\d+)]: " | transaction pid maxspan=60s | search winscp or accepted | rex field=_raw "version WinSCP_release(?\d).(?\d).(?\d)" | eval version=majv.minv1.minv2 | where version < 423 | rex "for (?[^ ]+) from" | eval ver=majv.".".minv1.".".minv2 | eval date=date_month."/".date_mday."/".date_year| table user ver date

looking for a suggestion to improve this search.

[vadud3]

So this is where I am now

http://picpaste.com/pics/splunk-Wz9dmCB4.1303775659.png

I like to generate a table output instead

user winscp_release

pgaul 4.1.8 or even WinSCP_release_4.1.8

[vadud3]

with the help of Ayn from #splunk I got this far

source="sshd.log" | rex field=_raw "sshd[(?\d+)]: " | transaction pid

So that is a good start

Also, a separate search like this works, which displays the events where winscp version
is lower than 4.0.4

source="sshd.log" | rex field=raw
"version WinSCP_release(?\d).(?\d).
(?\d)" |
eval version=major_version.minor_version1.minor_version2 | where version < 419

Now if both events has the same pid then display the event that happens in next 60s
with same pid and has the username displayed like below

Here is an exerpt of the log

http://pastebin.com/WNtyaJDN

Here is the result should look like

Apr 20 16:17:11 www2 sshd[10895]: [ID 800047 auth.debug] debug1: userauth-request for user pgaul service ssh-connection method none

because user pgaul using an winscp whose version is higher than 4.2.0