How do you correlate data across two sources with time comparison between events?

[blascola]

I want to create an alert for when a user logs in without badging a door within 8 hours prior. My login logs and door logs are in two separate indexes and source types. I created an alias in both source types so the account name field matches. Is there a way to do a time comparison within an eval similar to eval login=if(login to door time >= 8hrs,bad,good)?

[laurie_gellatly]

http://wiki.splunk.com/Community:UseSplunkForEventCorrelation might help and/or consider using stats.

You might be able to improve on this with a single stats command, but at least this should work and give you the ability to specify different time ranges per index:

index=logins
| stats max(_time) as lt by account 
| join account [ search index=door_time | stats min(_time) as ft by account | fields + ft account] 
| eval duration = lt-ft 
| table duration lt ft account

Assumes that 'account' is your user name that matches in both indexes.

...Laurie:{)