I want to make a search that match for a event, than get the next event.
Example:
Event1 _time event_hash status_label
Event2 _time event_hash status_label
Event3 _time event_hash status_label
Event4 _time event_hash status_label
Match:
Event2 _time event_hash status_label
Event3 _time event_hash status_label
Match:
Event1 _time event_hash status_label
Event2 _time event_hash status_label
hi @johnny_goya
Did the answer below solve your problem? If so, please resolve this post by approving it!
If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!
From given example what I understand is.
Below is your event
Event1 _time event_hash status_label
Event2 _time event_hash status_label
Event3 _time event_hash status_label
Event4 _time event_hash status_label
Below is your matching event from any logic
Event2 _time event_hash status_label
Event3 _time event_hash status_label
AND
Below is your desired output
Event1 _time event_hash status_label
Event2 _time event_hash status_label
Well, if it is then try following search.
YOUR_SEARCH | eval match=<<YOUR_MATCHING_LOGIC>> | streamstats window=2 earliest(_raw) as prev_event | where match=1
Note: I have taken an assumption we have already match field which represents event is matched or not.
YOUR_MATCHING_LOGIC should return 1
incase of true and 0
in case of false.
My Sample Search:
| makeresults
| eval _raw="Event1 _time event_hash status_label
Event2 _time event_hash status_label match=1
Event3 _time event_hash status_label match=1
Event4 _time event_hash status_label"
| rex max_match=0 field=_raw "(?<T>[^[\n|\.]+)"
| mvexpand T
| eval _raw=T
| fields - T | kv | streamstats window=2 earliest(_raw) as prev_event | where match=1
Thanks