Splunk Search

Event correlation between two index

sgambhir0109
New Member

I want to correlate events between two index

Index=A

Index = B

There are multiple user field(user, src_user, dsuer) under Index A. I have to search user in index A which have  signature=password retrieved and need to check the same user in Index B if there is successful login(action=success) in 30 sec duration when user has retrieved the password.

 

Thank you in advance.

Labels (1)
0 Karma

shugup2923
Path Finder

Have you tried using JOIN command, as you have user as common field you can try using it.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!