How to get events after error occured.

[Mondaya13]

Hello everyone, I am new to Splunk. I am trying to get the queue or event counts with status=“spooling” that happened after the very first error(status=“printing,error”) occurred. How could I do this?

So I have events with:

sourcetype=winprintmon host=bartender2020
type=PrintJob
printer="*"(gets all printer) ex: zebra1065
could have status of "printing"/"printing,error"/"spooling"

so what I wanted to do is if a printer has error(status="printing,error") at 6am,  count the events of that printer that has status="spooling"(which is the queue) that occurred after 6am.

Desired result format:
printer name      |          Counts of spooling(queue)         |

Hope this explains better, been dealing with this for days 
Thank you so much in advance! 

[bowesmana]

You're probably going to need streamstats - here's an example that demonstrates 5 printers with randomised printing, error and spooling statuses and it then uses streamstats to find each occurrence of printer_error and then counts the occurrences of spooling after the error - it handles multiple occurences of error followed by spooling

| makeresults count=1000
| streamstats c
| eval _time=now() - (c * 60)
| sort _time
| eval printer="Printer ".(random() % 5), r=random() % 100, status=case(r<3, "printing,error", r<90, "printing", r<100, "spooling")
| fields - r c
| search status IN ("printing,error","spooling")

``` Up to the above is just creating dummy data then removing all the
    printing events so just error and spooling are left ```

``` Create an occurrence group for each failure ```
| streamstats count(eval(status="printing,error")) as occurrence by  printer
``` Ignore the first as it's not relevant here ```
| where occurrence>0
``` Now count spooling events by failure occurrence and save start/end times ```
| stats min(_time) as printer_error max(_time) as last_spooling count(eval(status="spooling")) as spooling by occurrence printer
| fieldformat last_spooling=strftime(last_spooling, "%F %T")
| fieldformat printer_error=strftime(printer_error, "%F %T")
| sort printer printer_error

Hopefully this will give you something to start with