How to get the first transaction after an event of a different kind occurs (e.g. service starts up)?

marnee — Tue, 22 Dec 2020 18:57:56 GMT

I want to find the first transaction that occurs after a different type of event.

Let's say we have this event:

"Service ready"

Then we have these events:

traceId=123 "Authentication started"

traceId=123 "Authentication complete"

I want to find this transaction:

sourcetype=mytype

| transaction traceId startswith="Authentication started" endswith="Authentication complete"

But I want to filter these transaction and only see the first one that occurs after the "Service ready" event.

topic How to get the first transaction after an event of a different kind occurs (e.g. service starts up)? in Splunk Search