correlate 2 events

[roopeshetty]

Hi Guys,

We will have 2 events within a fraction of 3- 4 seconds when ever a user fail to login to our application as below;

2019-12-23 08:03:10 192.168.57.88 - 10.10.10.1 USER Peter profileID 1d48057e-1115-4254-981d-c789f7f47ca4 -
2019-12-23 08:03:13 192.168.57.88 - 10.10.10.1 LoginFailed profileID 1d48057e-1115-4254-981d-c789f7f47ca4 –

Here USER names will be logged in the first event and the Login Status as LoginFailed will be logged in second event. Hence, we are struggling to create the alerts or dashboards which contains the USER names along with the Login Status when the Login failures happens. Can some one please provide us the query which will join or correlate above 2 lines and show the output with USER name as well Login Status.
Please note that we can use the ProfileID as the common factor between these 2 events as this will be same in both the events for a user.

[richgalloway]

Try ... | stats latest(_time) as _time, values(*) as * by profileID | table _time USER profileID LoginStatus.