Hi all, I'm fairly new to splunk and was wondering if someone could point me in the direction I need to go. I'm having trouble with making searches that will show when event A occurs and then event B occurs after within a time frame. The after part is crucial as the inverse occurrence is less important to us. Some examples: A system has a log in the antivirus malware index then within a short period of time has over 100 blocked websites (logs in proxy index) A system has downloaded a file (logs in proxy index) then within a short period of time has over 100 blocked websites (logs in proxy index) A system has a log in the ids index then within a short period of time has excessive blocks on the firewall (logs in firewall index) I don't need help formulating the pieces of the search, such as how to find if there are 100 blocked sites or if a file was downloaded. The bigger issue is how do I say if event A and after event B occurs within a specific time range. Thanks, Kim ... View more