There are two different parts to your question.
First, can you detect a series of events that have other events interspersed? Yes, of course.
Second, can you "mark" them or flag them? In a search, yes. However, not in terms of a data model or tags, since those are based on individual events.
In order to give you the best advices, we would need more information on the sequence. You said A > B > A, but your data shows only A > B > B.
This search is likely to use a streamstats command of some sort.
Let's suppose you only care when an A changes to B or back to A. Here's a run-anywhere example that marks the records you want to flag.
| makeresults
| eval mydata="01.01.2018,A;02.01.2018,X;03.01.2018,Q;04.01.2018,B;05.01.2018,G;06.01.2018,X;07.01.2018,R;08.01.2018,B;09.01.2018,A;"
| makemv delim=";" mydata
| mvexpand mydata
| makemv delim="," mydata
| eval _time=strptime(mvindex(mydata,0),"%m.%d.%Y")
| eval Event=mvindex(mydata,1)
| eval Host="test"
| table _time Event Host
| rename COMMENT as "The above enters your test data. We've added a key (Host) in case you have multiple sets of data at one time"
| rename COMMENT as "Mark the events we care about"
| eval checkme=case(Event="A",Event, Event="B",Event)
| rename COMMENT as "Copy the related values forward, only on the records we care about."
| streamstats current=f last(checkme) as lastcheck by Host
| rename COMMENT as "If the values exist and have changed, flag the event."
| eval flagme=case(lastcheck!=checkme,"Y")
That's it. Replace by Host with the keys you care about, or eliminate it completely if you only need to process one set of transactions at a time.
