The invention discloses an event processing method in a software defined network (SDN). The method comprises following steps of successively applying corresponding time stamps for the multiple commands by lower layer controllers when multiple commands of upper layer applications (APP) or upper controllers are received; sending the corresponding time stamps and the multiple commands to corresponding forwarding layer network devices; and successively executing the commands according to the time stamps corresponding to the commands after the forwarding layer network devices receive the multiple commands. The invention also discloses a controller, a forwarding layer network device and an event processing system in the SDN.