probably you should try to better describe your requirement!
whick data source are you speaking?
why do you speak of Correlation Search?
did you checked if in Splunk baseline there's some Use Case for your technology?
did you checked if in Splunk Security essentials App there's some Use Case for your technology?
PDM is an acronym that I don't know and that you used.
In few words, you have to:
in this way , you should have something like this, to find events where user is present in both data sources:
(index=index1 sourcetype=sourcetype1) OR (index=index2 sourcetype=sourcetype2) | stats dc(index) AS index_count values(index) AS index BY user | where index_count=2
You're on different track my requirement is if single user triggers an alert say alert_name other than pdm in between 2 hours more than 3 times .
How could we achieve it using eval .
so the condition is triggering an alert, not that the alert must be in both the indexes,
in this case, please try the same with a different final condition:
(index=index1 sourcetype=sourcetype1) OR (index=index2 sourcetype=sourcetype2) | stats dc(index) AS index_count values(index) AS index values(pdm) AS pdm BY user | where index_count=1 AND index=index1
the thing that I don't understand is what's the condition for pdm.