Hello, I am very new to Splunk. I want to trigger an alert when a second event does not occur within 20min of the first event. Index and souurcetype is the same for both the events. Both these events have the same value for the requestId field but different value for the message field.
For example,
First Event:
Event A
level: INFO
logger_name: filename1
message: First event
requestId: 12345
thread_name: http-t2
timestamp: 2022-12-19T05:44:51.757Z
Event B
level: INFO
logger_name: filename1
message: First event
requestId: 67890
thread_name: http-t2
timestamp: 2022-12-19T05:44:51.757Z
Second Event:
Event C
level: INFO
logger_name: filename2
message: Second Event
requestId: 12345
thread_name: http-t1
timestamp: 2022-12-19T05:44:51.926Z
Since Event B with request ID: 67890 does not have a second event with the same request ID, I want Event B as my output,
level: INFO
logger_name: filename1
message: First event
requestId: 67890
thread_name: http-t2
timestamp: 2022-12-19T05:44:51.757Z
Please any help is appreciated
... View more