Retrieving All Events After the Second Instance of an Event

[Traer001]

Hello! 

I am having trouble creating a query to retrieve all of the events between now and the second instance of a particular event. For example, this could be how my events appear after grabbing the events for EntryType #1:

2021-03-29 13:27:11  EntryType #1 Issue Fixed

2021-03-29 13:26:23  EntryType #1 Something is Still Broken

2021-03-29 13:26:12  EntryType #1 Something is Still Broken

2021-03-29 13:25:56  EntryType #1 Something is Broken

2021-03-29 13:22:34  EntryType #1 Issue Fixed

2021-03-29 13:22:10  EntryType #1 Something is Broken

In this case, I would want to grab the first four events (from 13:25:56 to 13:27:11), but I cannot simply dedup 4 because  there could be more or less "Something is Broken" events between the "Issue Fixed" events.

My events are all from the same index, host and sourcetype, and I'm mainly just using regex to extract the events with certain phrases. Nevertheless, I can't seem isolate the events I need. Does anyone have any ideas?

[ITWhisperer]

| sort eventtype _time
| streamstats count(eval(message="Something is Broken")) as breaks by eventtype
| where breaks > 1