get all events, except for those occurring near time of other events

[elyp]

I need to get all the following events

               EventCode=4733

EXCEPT for any of those which occur within 5 seconds of some other events
              
               EventCode=1500 OR EventCode=1502

I'm having a hard time figuring out how to do this. How would one go about doing this, and does someone have an example query?

Note: A colleague proposed the following solution

EventCode=1500 OR EventCode=1502 OR EventCode=4733
| delta _time AS diff
| search EventCode=4733 AND diff>5

However, this also excludes multiple 4733 events if they occur near each other, regardless of whether 1500 or 1502 happened. So this solution will not work for me.

[DalJeanis · Accepted solution]

Try this...

index=foo (EventCode=4733 OR EventCode=1500 OR EventCode=1502)
| eval time150X=case(EventCode=1500,_time,EventCode=1502,_time)
| streamstats current=t last(time150X) as nextTime
| reverse 
| streamstats current=t last(time150X) as prevTime
| where EventCode=4733
| eval delta1=nextTime-_time
| eval delta2=_time-prevTime
| where (isnull(delta1) OR delta1>5) AND (isnull(delta2) OR delta2>5)

This eliminates all records that are within 5 seconds before or after a 1500 or 1502. If you only want to kill 4733 records where the 4733 is after the 150X, then only check delta2. If only before, then only check delta1.

---

Typo fixed EventCode.

[elyp]

This works! On the 2nd line, can you fix the capitalization typo by changing EventCODE=1502 to EventCode=1502? Thanks!