Find Event B Based on the time of Event A

[nkavouris]

I have a search which yields a time and correlated serial number for event A.

I want to use this time and serial number to search for event B, event B must meet criteria X

index="june_analytics_logs_prod" message=* new_state: Diagnostic, old_state: Home* NOT message=*counts*|
spath serial output=serial_number|
table _time, serial_number| ```table command is just for readability```

Criteria X:

• Event B must occur within 30s immediately after event A
• Event B must have the same serial number as event A
• Event B message field must contain the phrase "placeholder 123"

Any event that matches criteria X, I want to extract data from

How can I use this data from event A to search for event B? 

capture attached to show what current table looks like

[PickleRick]

Apart from your main question there are three issues with your search

1. You're using spath on the whole event which would mean that the fields are not auto-extracted. Where do you have your fields from then? It's a bit unclear to me.

2. Are you aware what is the difference between (message!=something) and (NOT message=something)?

3. The search term with a wildcard  at the beginning is gonna be very costly performance-wise.

OK. Having gone past that...

You can use streamstats to "copy" values from an event to subsequent events.

It's not clear what your search for event A is but the general idea would be:

<base search matching both eventA and eventB conditions>
| eval firsteventid=if(<criteria matching event A>)
| eval secondeventid=if(<criteria matching event B>)
| streamstats time_window=30s values(firsteventid) as previousfirsteventid ```here we do the copy-over```
| where secondeventid=previousfirsteventid ```if you can expect multiple firsteventids you might need to do some multivalue matching```