Monitoring for login failures - Events are on different lines

[cj039165]

I need to monitor for the following condition. The "PsftpManager.GetPsftpCommand Cmd:" string will get me the user ID that failed. The "PsftpManager.Execute SFTP returnCode: 1" tells me that the login failed. How do I link these two together. They are separated by 21 seconds in the logs. The "PsftpManager.GetPsftpCommand Cmd:" comes out in the logs for every successful and failed login attempt. I need to make sure I'm not showing a login ID for an event that worked and linking it to the return code:1. Hope I'm not being confusing.

Log Example:
07/03/2016 08:05:00 DEBUG PsftpManager.GetPsftpCommand Started
07/03/2016 08:05:00 DEBUG PsftpManager.GetPsftpCommand Cmd: c:\adminscripts\psftp.exe -P 9999 -l PRJB0Y2@9999999 -pw Hdx$9999 -b f:\sftproot\custdm10.hdx-609\prod\0\reports\inbound\himk\rad979F1.tmp -bc -v -batch 10.174.13.58 > f:\sftproot\custdm10.hdx-609\prod\0\reports\inbound\himk\radAAAE0.tmp
07/03/2016 08:05:21 ERROR PsftpManager.Execute SFTP returnCode: 1

Thanks

[sundareshr]

Try this

...  | rex "(?<prg>PsftpManager)" | transaction startswith="PsftpManager.GetPsftpCommand Cmd" endswith="PsftpManager.Execute SFTP returnCode: 1" maxspan=30s | table prg duration eventcount

[cj039165]

This work well with only one exception. I'm seeing results with multiple sources in it. For example:

source = F:\SFTPROOT\custdm10.HDX-609\Fidelis.log source = F:\SFTPROOT\custdm10.HDX-609\Highmark.log

How do I get the results broken out so it's per source log?

Thanks!

[somesoni2]

Have a look at transaction command.
http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Transaction