Search event X that happend after event Y

Elastic Stack Kibana
2

Depending on your kibana version, view surrounding documents may be able to help. You can find it by expanding a document on the discover tab:

image
image.png1760×756 102 KB
. You can make sure you only get your process_name events by clicking on the magnifying class shown in the table next to your process_name field

It goes by document count instead of time range. If you need exactly 20 seconds you'll probably have to update the date picker exactly.