# Search event X that happend after event Y

**URL:** https://discuss.elastic.co/t/search-event-x-that-happend-after-event-y/101856
**Category:** Kibana
**Created:** [September 26, 2017, 1:57pm UTC](https://discuss.elastic.co/t/search-event-x-that-happend-after-event-y/101856 "2017-09-26T13:57:53Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![maor\_levi](https://avatars.discourse-cdn.com/v4/letter/m/58f4c7/32.png) [@maor\_levi](https://discuss.elastic.co/u/maor_levi)
#### Post date: [September 26, 2017, 1:57pm UTC](https://discuss.elastic.co/t/search-event-x-that-happend-after-event-y/101856/1 "2017-09-26T13:57:53Z")

</div>

I have an index that contain security evevts from endpoints.  
In the index there is event 4688 (process creation) and 4689 (process termination).  
There are the fields : event\_id, process\_name.  
I want to find all of the 4689 events that occurred at the 20 seconds after the creation of event 4688 with process\_name :"XXXX" on the same computer.

Is it possible to do this?

---

<div class="post-metadata">

### Author: ![jbudz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jbudz/32/45922_2.png) [@jbudz](https://discuss.elastic.co/u/jbudz)
#### Post date: [September 26, 2017, 9:10pm UTC](https://discuss.elastic.co/t/search-event-x-that-happend-after-event-y/101856/2 "2017-09-26T21:10:37Z")

</div>

Depending on your kibana version, view surrounding documents may be able to help. You can find it by expanding a document on the discover tab:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/f/4fb78958ab47897641093d55418648dd922d322d.png). You can make sure you only get your process\_name events by clicking on the magnifying class shown in the table next to your process\_name field

It goes by document count instead of time range. If you need exactly 20 seconds you'll probably have to update the date picker exactly.

---

<div class="post-metadata">

### Author: ![maor\_levi](https://avatars.discourse-cdn.com/v4/letter/m/58f4c7/32.png) [@maor\_levi](https://discuss.elastic.co/u/maor_levi)
#### Post date: [September 27, 2017, 10:09am UTC](https://discuss.elastic.co/t/search-event-x-that-happend-after-event-y/101856/3 "2017-09-27T10:09:08Z")

</div>

But I want to find all of them, not only a specific one.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 25, 2017, 10:09am UTC](https://discuss.elastic.co/t/search-event-x-that-happend-after-event-y/101856/4 "2017-10-25T10:09:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.