filtering for events occurring seconds before and after a given windows eventID

[mikefoti]

I would like to filter for events that occurred immediately before and after a given windows eventID. For example, if Windows Eventid 1234 occurs every so often, how can I create a filter, or grouping or transaction consisting of just the event with that eventID plus the 2 or 3 event before and after it?

[mikefoti]

I may be getting close... but would very much appreciate feedback... am I on the right track?

For now my goal has been scaled back to discovering what events occurred on servers 1, 2 & 3 at the same time as the event with eventID=15223. Later I will want to improve this to find events occurring within 1 second of this event.

host="server1" OR host="server2" OR host="server3" [search host="server1" OR host="server2" OR host="server3" winEventVwrEventID="15223" | fields + winEventVwrEventTIME]