Thanks for the replies but I think my explanation was not sufficient sorry about that. Basically, my query will look like something this:
This will list thousands of IP addresses and ports. I want to make sure if a there are 2 events within 5 seconds where source IP is 18.104.22.168 and source port is 11 and destination ip is 22.214.171.124 destination port 22 AND its reverse where source IP 126.96.36.199 source port 22 and destination ip 188.8.131.52 destination port 11 is happening then the result happening later is discarded - example:
In this example the result with 14:22:50 should be discarded. I don't want to match on IP but only match on a statement like "if a result X Y IP and port AND its reversed Y X IP and port" happened within 5 seconds I should only see the one which happened first. Hope I didn't confuse anyone : -)
You can do this somewhat with streamstats, but things get tricky because you are thinking in chronological order, and Splunk process events in reverse-chronological order by default. You can get around this sometimes with reverse, but using that for large datasets is a bad idea.
Is timestamp the only rule to exclude second result or there are other criteria? Are these two events related in some way? Will you always get two results or there can be more (and what happens when there are more resutls)?