Splunk Search

How to set up an alert to trigger if EventB from IndexB happens within 1 minute after EventA from IndexA?

dpanych
Communicator

I had a previous thread open, but since then I worked on the alert and refined some criteria. The alert is running off two indexes: ABC and windows (print logs). Basically what I want is, when the specific event from ABC happens AND right after (but no longer than 1 minute after) when the user prints the document “getContent.pdf,” I want it to alert. I got as far as joining the two logs together with the user field, but I am having trouble with the criteria, ONLY when the user prints the document after the specified ABC event, and I was also having trouble grouping by user.

See the screenshot below for example. The ABC event happens at 3:51:25 pm by user J0845, and soon after at 3:51:34pm the user prints getContent.pdf. That’s when I want it to alert.

Search:

(index=ABC Screen="DocDetl" Func="ViewImg" FileName="Your Number" UsrID=J0845) OR (sourcetype=WinPrintMon type=PrintJob user=J0845 "getContent.pdf")

alt text

1 Solution

dpanych
Communicator

Got it to work! Firstly, I had to create a field alias on the UsrID field (as user).

(index=ABC Screen="1" Function="2" Action="3" FileName="BLAH" UsrID=*) OR (sourcetype=WinPrintMon type=PrintJob user=* document="getContent.pdf")
| transaction user startswith=(FileName="BLAH") endswith=(*"getContent.pdf"*) maxspan=1m

View solution in original post

0 Karma

dpanych
Communicator

Got it to work! Firstly, I had to create a field alias on the UsrID field (as user).

(index=ABC Screen="1" Function="2" Action="3" FileName="BLAH" UsrID=*) OR (sourcetype=WinPrintMon type=PrintJob user=* document="getContent.pdf")
| transaction user startswith=(FileName="BLAH") endswith=(*"getContent.pdf"*) maxspan=1m
0 Karma

jkat54
SplunkTrust
SplunkTrust

Please just edit your existing question(s) instead of opening new questions.

This is remarkably similar to your other question: https://answers.splunk.com/answers/400912/how-do-i-join-on-fields-from-two-different-sources.html

and about 2-3 other questions you posted. This behavior makes me want to skip your questions.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...