How do I join on fields from two different sources with the two events being no more than 1 minute apart?

[dpanych]

I have two sources (the CM logs and print logs) where I'm trying to join on the User field, but I also want to return results only when the print log follows the CM log no more than 1 minute later.

By concept, this is what I have so far but it doesn't work:

(index=ABC Screen="DocDetl" Func="ViewImg" FileName="Document" UsrID=*) OR (sourcetype=WinPrintMon type=PrintJob user=* "blah_blah.pdf") | where UsrID=user

What's the most efficient way to accomplish this?

[woodcock]

Try this:

(index=ABC Screen="DocDetl" Func="ViewImg" FileName="Document" UsrID="*") OR (sourcetype=WinPrintMon type=PrintJob user="*" "blah_blah.pdf")
| eval JoinedUser=coalesce(UsrID,user)
| streamstats count(eval(sourcetype="WinPrintMon")) AS PrintSessionID BY JoinedUser
| eventstats latest(_time) AS PrintSessionTime by PrintSessionID JoinedUser
| eval KeepMe=if((((PrintSessionTime-_time) <= 60) AND NOT match(sourcetype,"^WinPrintMon$"))), "TRUE", null())
| eventstats dc(KeepMe) as KeepMeCount BY PrintSessionID JoinedUser
| where isnotnull(KeepMe) OR ((match(sourcetype,"^WinPrintMon$")) AND (KeepMeCount > 0))

[dpanych]

Not quite this, this brought back other events which aren't needed.

[woodcock]

I do not see how that is possible. It keeps only WinPrintMon events that have the other events that are closer than 1 minute earlier and also those other events.

[dpanych]

The results I'm expecting is 2-3 events; the search you helped with results in 15 events, ranging within 7 hours of each other.

See the screenshot below. The left is the ABC data and right is print logs. I'm trying to create an alert when the criteria on the left is triggered and if within a minute there is a print log with that document name and user, I want to be alerted.

[dpanych]

http://i.imgur.com/fXNI0se.png

[woodcock]

ARG! Cut/Paste stripped out some asterisk characters. I have re-edited the original answer. Try it now.