Splunk Search

How to set up an alert to trigger if EventB from IndexB happens within 1 minute after EventA from IndexA?

dpanych
Communicator

I had a previous thread open, but since then I worked on the alert and refined some criteria. The alert is running off two indexes: ABC and windows (print logs). Basically what I want is, when the specific event from ABC happens AND right after (but no longer than 1 minute after) when the user prints the document “getContent.pdf,” I want it to alert. I got as far as joining the two logs together with the user field, but I am having trouble with the criteria, ONLY when the user prints the document after the specified ABC event, and I was also having trouble grouping by user.

See the screenshot below for example. The ABC event happens at 3:51:25 pm by user J0845, and soon after at 3:51:34pm the user prints getContent.pdf. That’s when I want it to alert.

Search:

(index=ABC Screen="DocDetl" Func="ViewImg" FileName="Your Number" UsrID=J0845) OR (sourcetype=WinPrintMon type=PrintJob user=J0845 "getContent.pdf")

alt text

1 Solution

dpanych
Communicator

Got it to work! Firstly, I had to create a field alias on the UsrID field (as user).

(index=ABC Screen="1" Function="2" Action="3" FileName="BLAH" UsrID=*) OR (sourcetype=WinPrintMon type=PrintJob user=* document="getContent.pdf")
| transaction user startswith=(FileName="BLAH") endswith=(*"getContent.pdf"*) maxspan=1m

View solution in original post

0 Karma

dpanych
Communicator

Got it to work! Firstly, I had to create a field alias on the UsrID field (as user).

(index=ABC Screen="1" Function="2" Action="3" FileName="BLAH" UsrID=*) OR (sourcetype=WinPrintMon type=PrintJob user=* document="getContent.pdf")
| transaction user startswith=(FileName="BLAH") endswith=(*"getContent.pdf"*) maxspan=1m
0 Karma

jkat54
SplunkTrust
SplunkTrust

Please just edit your existing question(s) instead of opening new questions.

This is remarkably similar to your other question: https://answers.splunk.com/answers/400912/how-do-i-join-on-fields-from-two-different-sources.html

and about 2-3 other questions you posted. This behavior makes me want to skip your questions.

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...