How do you bucket two events starting using a timespan that starts with the first event?

[rkondeti3]

My question is a mix of using the transaction command with the bin command.

What I would like to achieve is capturing when 2 consecutive POST requests are made in proxy logs within two seconds of each other. Straight up using | _bin span=2s misses out on events that might happen during odd seconds.

Essentially, I want the two second timer to start when the first event occurs, and then looks for the next event (another POST request), within two seconds.

Is there a feasible way to achieve what I'm asking for? Or am I not making much sense?

[adonio]

when you say consecutive, do you mean that there is no other events in between those 2 POST events?
can you share some masked data sample?