How to write events within 2 minutes of the first event for the same host?

[Splunk77]

I am working on a query to report on events generated within 2 minutes of the first event for the same host.

In the following example, I need a query to look for any occurrence of EventType 4697 within two minutes of EventType 4624 for the same ComputerName

ComputerName=x (This is a unique field)

EventType=4624

EventType=4697

Thanks.

[VatsalJagani · Accepted solution]

@Splunk77 - Have you tried the transaction command like below:

index=<your_index> EventType=4624 OR EventType=4697
| transaction ComputerName startswith="EventType=4624" endswith="EventType=4697" maxspan=2m
| search EventType=4697

I hope this helps!!!

[Splunk77]

Running this query and not quite getting the desired results. I have test events generated within a 2 minute window. Expanded maxspan to 5 minutes to capture a larger window.