Comparing results to identify values that have a certain value in previous records

[Blueochotona]

The two raw results are as follows : 

(1)

EventType="Device" Event="InstallProfileConfirmed" User="sysadmin" EnrollmentUser="hasubram" DeviceFriendlyName="blabla MacBook Air macOS 15.3.2 Q6LW" EventSource="Device" EventModule="Devices" EventCategory="Command" EventData="Profile=Apple macOS Apple Intelligence Restrictions" Event Timestamp: Mar 28 09:29:40

(2)

EventType="Device" Event="DeviceOperatingSystemChanged" User="sysadmin" EnrollmentUser="hasubram" DeviceFriendlyName="blabla MacBook Air macOS 15.3.2 Q6LW" EventSource="Device" EventModule="Devices" EventCategory="Assignment" EventData="Device=75639" Event Timestamp: Mar 28 09:29:29

Hoping to combine a search to identify (1)‘s DeviceFriendlyName="blabla MacBook Air macOS 15.3.2 Q6LW" which is a shared key between two results , as long (2) happens before (1) from a chronological experience.

I am already using the following to try and exclude certain results too : 

Index=*** <<Search Parameters>> NOT  DeviceFriendlyName IN (*15.3.0*,*15.3.1*)

Thank you 🙂

[livehybrid]

Hi @Blueochotona 

Have a look at the following, does this achieve what you're looking for?

index=*** <<Search Parameters>> NOT DeviceFriendlyName IN (*15.3.0*,*15.3.1*)
(
    (EventType="Device" Event="DeviceOperatingSystemChanged")
    OR
    (EventType="Device" Event="InstallProfileConfirmed")
)
| eval {Event}_time=_time
| stats
    latest(*_time) as *_time
    values(Event) as events by DeviceFriendlyName
    
| where MATCH(events, "DeviceOperatingSystemChanged") AND MATCH(events, "InstallProfileConfirmed") AND DeviceOperatingSystemChanged_time < InstallProfileConfirmed_time

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

[livehybrid]

Here is a working example using makeresults too

| makeresults 
| eval _raw="EventType=\"Device\" Event=\"InstallProfileConfirmed\" User=\"sysadmin\" EnrollmentUser=\"hasubram\" DeviceFriendlyName=\"blabla MacBook Air macOS 15.3.2 Q6LW\" EventSource=\"Device\" EventModule=\"Devices\" EventCategory=\"Command\" EventData=\"Profile=Apple macOS Apple Intelligence Restrictions\" Event Timestamp: Mar 28 09:29:40" 
| append 
    [| makeresults 
    | eval _raw="EventType=\"Device\" Event=\"DeviceOperatingSystemChanged\" User=\"sysadmin\" EnrollmentUser=\"hasubram\" DeviceFriendlyName=\"blabla MacBook Air macOS 15.3.2 Q6LW\" EventSource=\"Device\" EventModule=\"Devices\" EventCategory=\"Assignment\" EventData=\"Device=75639\" Event Timestamp: Mar 28 09:29:29"] 
    | kv
| rex field=_raw "Event Timestamp: (?<EventTime>.+)$"    
| eval _time=strptime(EventTime, "%b %d %H:%M:%S")
| search DeviceFriendlyName="blabla MacBook Air macOS 15.3.2 Q6LW"
| eval {Event}_time=_time
| stats
    latest(*_time) as *_time
    values(Event) as events by DeviceFriendlyName
    
| where MATCH(events, "DeviceOperatingSystemChanged") AND MATCH(events, "InstallProfileConfirmed") AND DeviceOperatingSystemChanged_time < InstallProfileConfirmed_time

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

[Blueochotona]

Very kewl 🙂 

Thank you 🙂 Will give it a shot for sure ! 

[livehybrid]

Excellent, let us know how you get on 🙂

Will