How to trigger alert when there is switch between events for the first time?

[paragg]

I want to get an alert when there is switch between events for the first time. Below is the example for this. 

index=abc sourcetype=xyz  <warning>

index=abc sourcetype=xyz  <critical>

These 2 queries I have and I want an alert when there is switch between from <warning> to <critical>.

Please help with the query.

[bowesmana]

You should look at using streamstats - here's an example that creates 10 events where every 4th event changes from warning to critical.

| makeresults count=10
| streamstats c
| eval _time=now() - c
| eval type=if(c % 4 = 0, "critical", "warning")
| fields - c
| sort - _time
| streamstats count reset_after="("type=\"warning\"")" by type
| where count=1 AND type="critical"

To give you an exact solution would need to know more about your requirement.

This will give 2 results when the type changes to critical from warning