Search that Alerts for two events with a matching field

[jinito14002]

Hi I'm new to Splunk and am having a hard time finding a simple solution to this.
I tried using subsearch and append but couldn't do it. Wherever I look, it only has complicated solutions with at least 5 pipes.
How do I create an alert if two certain events occurred and their ip addresses match? (Source OR Destination ip whichever)
1. index=snort sid=100 src_ip=192.168.1.3 dst_ip=192.168.1.5
2. index=snort sid=101 src_ip=192.168.1.5 dst_ip=192.168.1.3

If its possible to check whether if event #2 occurred within 5 minutes of event #1 at the same time, that would be great.

[gcusello]

HI jinito14002,
try something like this:

index=snort
| eval ip=src_ip.",".dst_ip
| makemv ip delim=","
| mvexpand ip
| stats count BY ip
| where count>1

Bye.
Giuseppe

[aohls · Accepted solution]

I am not sure what extracts you have setup but you could use a transaction: https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Transaction

| transaction src_ip maxspan=5m

Need some more information to get things exact but it seems using transaction should work. If you can provide some more information that would help.

[jinito14002]

Thanks, this did the trick for me. just needed that one word "transaction"