How to filter two different actions events based on a common field in both

[massumtaqi]

if an action 1 triggers one event of common field=A and action 2 triggers ten events of common field= A, B or C. How do i identify and filter the Acton 1 and 2 separately?

[woodcock]

Like this (or similar):

((index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="AndSourcetypeToo") OR (index="YouShouldAlwaysSpecifyOtherIndex" AND sourcetype="AndOtherSourcetypeToo")) AND Logon_Type="*"
| stats latest(_raw) AS _raw count dc(sourcetype) AS sourcetypeCount BY host
| where count>1 OR sourcetypeCount>1

[massumtaqi]

EventCode=4624
| rex "(?ms)Logon Type:...(?<Logon_Type>\w+)"
| rex "(?ms)New Logon:\s+Security ID:..(?<Login_Security_ID>[AEW]+.\w+.\w+)"
| where (like (Login_Security_ID,"%mtaqi.a%"))
| where Logon_GUID!="{00000000-0000-0000-0000-000000000000}"

This is my code above that shows all 13 events for both actions . what do i do to see only event 1 of logon_type 3 caused by first action ?

The code you provided also show all 13 events

[woodcock]

Show sample events and mockup of desired final output.

[massumtaqi]

Action one triggers 1 event :

Logon_Type
3
_time
2019-05-10T14:38:12.000-0400

Action two triggers 12 concurrent events :

Logon_Type
3
3
3
3
3
3
3
3
3
3
10
3

_time
2019-05-10T14:32:13.000-0400
2019-05-10T14:32:12.000-0400
2019-05-10T14:32:12.000-0400
2019-05-10T14:32:12.000-0400
2019-05-10T14:32:12.000-0400
2019-05-10T14:32:12.000-0400
2019-05-10T14:32:12.000-0400
2019-05-10T14:32:12.000-0400
2019-05-10T14:32:11.000-0400
2019-05-10T14:32:11.000-0400
2019-05-10T14:32:10.000-0400

I want to see first one only

[woodcock]

First of all, your sample events don't make sense: your "first event" has a timestamp after all of the other events that "it caused" and your 12 events only have 11 timestamps listed (worst of all, the one that is not there is the most important one, the one that you desire). You should install the Windows TA so that your field extractions are automatic. I say this all the time: sow us your sample events (you were close but not all the way there), and a mockup of your desired final output. Then we can help.