| tstats
...
from datamodel=my_dataset
groupby _time
| eval
detection_time_end=strftime((relative_time(event_time,"+`Z`")), "%F %T.%Q"),
only_type1=if((event_type="type1"),1,null)
| stats
earliest(event_time) as earliest_time,
earliest(detection_time_end) as end_of_detection_time,
dc(field1) as number_of_different_field1_events,
dc(field2) as number_of_different_field2_events,
by user, only_type1
I'll take a more literal approach, like
field1 > X OR field2 > Y
| append
[| tstats min(_time) as first_time where event_type = "type1"] ``` this assumes event_type is indexed - can be more sophisticated if this is not true ```
| eventstats values(first_time) as first_type1 ``` just to populate first_type1 ```
| where first_type1 < event_time and event_time < relative_time(first_type1, "+" . Z . "min")
| stats dc(field1) as number_of_different_field1_events,
dc(field2) as number_of_different_field2_events
by user
Obviously, where the "first" type1 event occurs is dependent on the actual search window. The above assumes that event_type is indexed, although if you cannot use tstats, you can still use a search to do the same.
There must be a way to not even use subsearch because data is already available in the main search. I just haven't seen it.