Transaction based Alert Trigger with multiple conditions

[mfritsch]

I like to create a trigger which fires based multiple conditions

Example Scenario:
A per person is entering a room and the door sensor sends an open event to splunk.
Next the person switch on the light. The light sensor send the "on" event to splunk.
The person leaves the room without switch the light off. A door close event is send to splunk.
Result the person forget to switch of the light. I like to detect this.

I have two indexs

Index 1: DoorSensors
Timestamp, DoorID, State
2017-10-06 12:01:30, Door1, Open
2017-10-06 12:03:50, Door1, Close

Index 2: LightSensors
Timestamp, LightSensor, State
2017-10-06 12:01:35, Light1, On

How to detected by a alert trigger that someone forgot to turn off the light?
I like to run this in real-time.

[gcusello]

Hi mfritsch,
I don't see in index2 (LightSensors) the room where the light is positioned so I can image that this is an example and that i can extrapolate the room number from the LightID field number (e.g. light1 is in room1) .
So you could run something like this

index=LightSensors State="On" 
| rex field=LightSensor "Light(?<LightRoom>\d+)"
| eval DoorID="Door"+LightRoom
| search [ search index=DoorSensors | stats values(State) AS DoorState BY DoorID | search State="Open" State="Close" | fields DoorID]
| table _time DoorID

if you could have the room number in index 2 the search is easier:

index=LightSensors State="On" [ search index=DoorSensors | stats values(State) AS DoorState BY DoorID | search State="Open" State="Close" | fields DoorID]
| table _time DoorID

To manage the presence of more doors or more lights for each room you have only to find the rule to extrapolate the room number.

You could also use transaction command in the subsearch but this solution is more performant.

Bye.
Giuseppe