What is the most efficient way to correlate results from two separate searches? I can perform two searches, but only want to see the end results when they meet very specific criteria applied to both original search results.
For example:
Search 1: [Sourcetype = Enter]
Returns results like this:
Sourcetype = Enter
Time = 11:05AM
Employee = Sara
Door = West#3
Shirt = Red
Search 2: [Sourcetype = Exit]
Returns results like this:
Sourcetype = Exit
Time = 11:08AM
Employee = Sara
Door = West#3
Shirt = Blue
I am only interested in the specific situation where someone enters and leaves through the same door, within 5 minutes, and is wearing a different shirt (the events above).
I am not even sure the best approach in general to take here.
Any help is appreciated.
Thanks.
