How can i get the first event after match a event?

[johnny_goya]

I want to make a search that match for a event, than get the next event.

Example:

Event1 _time event_hash status_label
Event2 _time event_hash status_label
Event3 _time event_hash status_label
Event4 _time event_hash status_label

Match:
Event2 _time event_hash status_label
Event3 _time event_hash status_label

Match:
Event1 _time event_hash status_label
Event2 _time event_hash status_label

[mstjohn_splunk]

hi @johnny_goya

Did the answer below solve your problem? If so, please resolve this post by approving it!
If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

[kamlesh_vaghela]

@johnny_goya

From given example what I understand is.

Below is your event

Event1 _time event_hash status_label
Event2 _time event_hash status_label
Event3 _time event_hash status_label
Event4 _time event_hash status_label

Below is your matching event from any logic

Event2 _time event_hash status_label
Event3 _time event_hash status_label

AND
Below is your desired output

Event1 _time event_hash status_label
Event2 _time event_hash status_label

Well, if it is then try following search.

YOUR_SEARCH | eval match=<<YOUR_MATCHING_LOGIC>> | streamstats window=2 earliest(_raw) as prev_event | where match=1

Note: I have taken an assumption we have already match field which represents event is matched or not.
YOUR_MATCHING_LOGIC should return 1 incase of true and 0 in case of false.

My Sample Search:

| makeresults 
| eval _raw="Event1 _time event_hash status_label
Event2 _time event_hash status_label match=1
Event3 _time event_hash status_label match=1
Event4 _time event_hash status_label" 
| rex max_match=0 field=_raw "(?<T>[^[\n|\.]+)" 
| mvexpand T
| eval _raw=T 
| fields - T | kv | streamstats window=2 earliest(_raw) as prev_event | where match=1

Thanks