is it possible to make watch that looks forward to two or more logs of different type but one field in common?
log A - AD login
log B - DB login
I want to set up watch that looks for both logs (in time window set in watch check), with the same user but i dont want to define user as string in watch because i dont yet know which user will behave as described.
Filter description of log A + Filter description of log B but logs are matched by the same user narme.
User "Red Baron" logs into the Active Directory and logs to Database normally. - > No Watch Event
User "John Doe" logs into the Active Directory but user "John Doe" fails to login to Database. - > Watch event is generated
User "Bill Gates" logs into the Active Directory but user "Bill Gates" fails to login to Database. - > Watch event is generated
Is it possible to recieve output as above?