I would like to filter for events that occurred immediately before and after a given windows eventID. For example, if Windows Eventid 1234 occurs every so often, how can I create a filter, or grouping or transaction consisting of just the event with that eventID plus the 2 or 3 event before and after it?
I may be getting close... but would very much appreciate feedback... am I on the right track?
For now my goal has been scaled back to discovering what events occurred on servers 1, 2 & 3 at the same time as the event with eventID=15223. Later I will want to improve this to find events occurring within 1 second of this event.
host="server1" OR host="server2" OR host="server3" [search host="server1" OR host="server2" OR host="server3" winEventVwrEventID="15223" | fields + winEventVwrEventTIME]