Ok easier the aspect of the device! you could use something like this source="My Source" | stats dc(src_ip) as count values(src_ip) as src_ip earliest(_time) AS earliest latest(_time) AS latest BY user device_id | where count > 1 AND latest-earliest<300 where you can configure the maximum accepted delay between events (in my example 300 seconds). Ciao. Giuseppe ... View more

the file is as follow query ... DnsAdmins DnsUpdateProxy Domain Admins Domain Admins Restriction Domain Computers Domain Controllers COMPUTER1 Admins ... thanks for your help ... View more

@cnoulin as @somesoni2 mentioned, stats is a better option for your use case. However, for us to assist you better you would need to provide more details on what fields and values you want to show after correlating them. If you lookup Splunk Answers you will find several examples. sourcetype="cisco:esa:textmail" | stats count as eventCount min(_time) as _time max(_time) as LatestTime internal_message_id | eval duration=LatestTime-_time | fields - LatestTime ... View more

thank you fir your answer. With your help i have now a working app. i have changed in props.conf of the TA-cisco_ios following line : [cisco:ios] [(?::){0}network:cisco_*] ... nothing in the transforms.conf and in the cisco_ios i have created a local/eventtypes.conf with theses lines : [cisco_ios] search = (sourcetype=network:cisco_switch OR sourcetype=network:cisco_wlc OR sourcetype=network:cisco_coeur_reseau) Thanks again ... View more