Extract two adjacent events

[myli12]

I want to extract two adjacent events, i.e., the first one with keyword "synchronization" and the event immediately follows the "synchronization" in the log file. Then I can use regular expression to extract some values from these two events.

I tried to use transaction to accomplish this. I cannot rely on event time (i.e., cannot rely on maxspan) as there is a problem with clock synchronization).

The script I used is
host=A | transaction host startswith="synchronization" maxevents=2

The result includes many transactions that don't begin with "synchronization."
1) Can you help to fix the transaction script so the result contains only the transactions that start with the "synchronization" event.
2) Is there any other way than "transaction" to extract two adjacent events?

[Ayn]

The startswith directive does not tell Splunk to return only transactions that actually begin with the string you're supplying. Rather it tells Splunk that when it encounters a line that matches the startswith directive, it marks the beginning of a new transaction. If you're familiar with event breaking settings in props.conf, think of it as transaction's version of BREAK_ONLY_BEFORE.

You could still use the search you already started, just add a search directive to filter the transactions that did not include the "synchronization" string.

host=A | transaction host startswith="synchronization" maxevents=2 | search synchronization

The transactions you end up with after this should be the ones starting with "synchronization" and including the event occurring directly after that. The only situation when this will not be the case is if two events containing "synchronization" are adjacent to each other, as Splunk will then immediately break out a new transaction when it encounters "synchronization" in the second event as well.