I want to find the first transaction that occurs after a different type of event.
Let's say we have this event:
"Service ready"
Then we have these events:
traceId=123 "Authentication started"
traceId=123 "Authentication complete"
I want to find this transaction:
sourcetype=mytype
| transaction traceId startswith="Authentication started" endswith="Authentication complete"
But I want to filter these transaction and only see the first one that occurs after the "Service ready" event.