These are the Splunk query and it seems not working because i cant generate any request from that. Please I need any help to be able to generate a search. Any help would be appreciated, thanks   index=aws-cloudtrail "userIdentity.type"=Root AND NOT eventType="AwsServiceEvent" |eval nullParentProcess=if(isnull("userIdentity.invokedBy"),true,false) |search nullParentProcess=true |convert ctime(_time) as _time |stats values(dest) values(eventType) values(eventName) values(userName) latest(_time) by src |rename values as * |head 51 ... View more

I have two Splunk queries 1 and 2 below, and both have one common email , i want the searched emails generated from the result which are email variable to be able to send an alert notification base on the search result generated email. I need the common value to have the field with matching values in both queries which is the email , then be able to send an email alert notification Query-1 index="aws-cloudtrail" eventName="AssumeRoleWithSAML" |fields * | spath "requestParameters.roleArn" |search "*super*admin*" | rex field=responseElements.subject "(?<Email>[a-zA-Z0-9]{1,8}@digitlogs.com$)" | search Email=* | table Email,"recipientAccountId" | dedup Email, "recipientAccountId" Query-2 index="okta" displayMessage="Authenticate user with AD agent" | rename target{}.alternateId as email | eval my_ponies=mvindex(email, -3, -2) | eval Email=mvindex(email, 0) | eval email=mvindex(email, 1) | table Email email Here are the two of them, please any input will help ... View more