Splunk Search

How to set up an alert to trigger if EventB from IndexB happens within 1 minute after EventA from IndexA?

dpanych
Communicator

I had a previous thread open, but since then I worked on the alert and refined some criteria. The alert is running off two indexes: ABC and windows (print logs). Basically what I want is, when the specific event from ABC happens AND right after (but no longer than 1 minute after) when the user prints the document “getContent.pdf,” I want it to alert. I got as far as joining the two logs together with the user field, but I am having trouble with the criteria, ONLY when the user prints the document after the specified ABC event, and I was also having trouble grouping by user.

See the screenshot below for example. The ABC event happens at 3:51:25 pm by user J0845, and soon after at 3:51:34pm the user prints getContent.pdf. That’s when I want it to alert.

Search:

(index=ABC Screen="DocDetl" Func="ViewImg" FileName="Your Number" UsrID=J0845) OR (sourcetype=WinPrintMon type=PrintJob user=J0845 "getContent.pdf")

alt text

1 Solution

dpanych
Communicator

Got it to work! Firstly, I had to create a field alias on the UsrID field (as user).

(index=ABC Screen="1" Function="2" Action="3" FileName="BLAH" UsrID=*) OR (sourcetype=WinPrintMon type=PrintJob user=* document="getContent.pdf")
| transaction user startswith=(FileName="BLAH") endswith=(*"getContent.pdf"*) maxspan=1m

View solution in original post

0 Karma

dpanych
Communicator

Got it to work! Firstly, I had to create a field alias on the UsrID field (as user).

(index=ABC Screen="1" Function="2" Action="3" FileName="BLAH" UsrID=*) OR (sourcetype=WinPrintMon type=PrintJob user=* document="getContent.pdf")
| transaction user startswith=(FileName="BLAH") endswith=(*"getContent.pdf"*) maxspan=1m
0 Karma

jkat54
SplunkTrust
SplunkTrust

Please just edit your existing question(s) instead of opening new questions.

This is remarkably similar to your other question: https://answers.splunk.com/answers/400912/how-do-i-join-on-fields-from-two-different-sources.html

and about 2-3 other questions you posted. This behavior makes me want to skip your questions.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...