Ignore if a certain string is present in the next X min

[grasshopper_]

Hi, 

I am working on a search that looks for instances of "string1", but only those that are not followed by instances of "string2" in X minutes of time. The search runs once every 24hrs and should produce a total count of the instances found.

I am trying to search with bin command.

| index=x

| search "string1" NOT "string2"

| bin _time span=5min

The problem is that this search looks for 5min in the past, as well as 5min in the future. So if "string2" is present within -5min from "string1",  that instance does not get counted, and it should be. It should only be excluded if "string2" is after  "string1".

Many Thanks

[ITWhisperer]

Try something along these lines - I have used dummy data at 10 minute intervals over a day and looked for string1 which wasn't followed by string2 within an hour, but you should be able to adapt for your usecase.

| gentimes start=-1 increment=10m | rename starttime as _time | fields - endhuman endtime starthuman
| eval field="string".random()%10



| sort 0 -_time
| eval found2=if(field="string2",_time,null())
| streamstats last(found2) as found2
| eval diff=if(field="string1",found2-_time,null())
| where field="string1" AND diff>3600

[grasshopper_]

 I keep adapting it. If you wanted to make sure that string1 and string2 are from the same host, at what point would you put that? Thanks

[ITWhisperer]

| gentimes start=-1 increment=10m | rename starttime as _time | fields - endhuman endtime starthuman
| eval field="string".random()%10
| eval host="host".mvindex(split("ABC",""),random()%3)



| sort 0 -_time
| eval found2=if(field="string2",_time,null())
| streamstats last(found2) as found2 by host
| eval diff=if(field="string1",found2-_time,null())
| where field="string1" AND diff>3600