How to get events after error occured.

[Mondaya13]

Hello everyone, I am trying to get the queue or event counts with status=“spooling” that happened after the very first error(status=“*error*”) occurred. How could I do this? Thank you in advance. 

this is for our company’s printer server. 

[ITWhisperer]

Please share some anonymised but representative events that you are dealing with, preferably in a code block to preserve any formatting data.

[Mondaya13]

So I have events with:

sourcetype=winprintmon host=bartender2020
type=PrintJob
printer="*"(gets all printer) ex: zebra1065
could have status of "printing"/"printing,error"/"spooling"

so what I wanted to do is if a printer has error(status="printing,error") at 6am, get the events of that printer that has status="spooling"(which is the queue) that occurred after 6am and count them. 

Desired result format:

printer name      |          Counts of spooling(queue)         |

Hope this explains better, been dealing with this for days 
Thank you so much in advance!