Alerting

Correlate data between 2 seperate source and Alert on conditions

amN0P
Explorer

Hello,
I want to correlate data between logs collected from 2 different sources and I want to alert when a condition is met. How can I create a search for this. Example:

Source 1 log output is: source1_ipaddress visiting_particular_url
Source 2 log output is: source2_ipaddress hostname username

I want to send email alert containing "username" from Source 2 whenever Source 1 logs the event AND source1_ipaddress=source2_ipaddress.
How can I do this? Will appreciate your response. Thanks.

Tags (1)
0 Karma

cpeteman
Contributor

This is a duplicate question. It should be removed I believe.

0 Karma

sairic81
New Member

I am also interested in doing something similar - I am particularly concerned with correlating an alert based off of 2 performance counters. For example: we would like to watch % processor time and available mbytes - should both breach certain conditions then send an alert to me.

Any help would be appreciated.

0 Karma

linu1988
Champion

Its easy, index=blah counter=% processor time| eval CPU_Usage=value|join host[search index=blah counter=% available mbytes|eval Mem_Usage=value]| table host,CPU_Usage,Mem_Usage| where Condition|eval Status=if(CPU_Usage>50 AND Mem_Usage>(any value),"Warning","Critical")

Same goes for the above question.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...