Hi I'm new to Splunk and am having a hard time finding a simple solution to this. I tried using subsearch and append but couldn't do it. Wherever I look, it only has complicated solutions with at least 5 pipes. How do I create an alert if two certain events occurred and their ip addresses match? (Source OR Destination ip whichever) 1. index=snort sid=100 src_ip=192.168.1.3 dst_ip=192.168.1.5 2. index=snort sid=101 src_ip=192.168.1.5 dst_ip=192.168.1.3 If its possible to check whether if event #2 occurred within 5 minutes of event #1 at the same time, that would be great. ... View more