https://community.splunk.com/t5/Getting-Data-In/Calculate-duration-of-two-different-events/m-p/579250#M102265 <P>The <FONT face="courier new,courier">range</FONT> function should do the job.&nbsp; It computes the difference between the first and last events.</P><LI-CODE lang="markup">index=infra_automation sourcetype=rundeck_execution | stats range(_time) as duration, latest(status) as last_status by job_id | sort - job_id | eval duration = tostring(duration,"duration") | table job_id data time last_status duration</LI-CODE><P>&nbsp;</P> Fri, 24 Dec 2021 22:02:12 GMT richgalloway 2021-12-24T22:02:12Z https://community.splunk.com/t5/Getting-Data-In/Calculate-duration-of-two-different-events/m-p/579248#M102264 <P>I have logs which shows the job status ( Running, succeeded and failed) and all jobs have unique job id , now I want to calculate the duration it took to get failed or succeeded for each job id. Here, all jobs id would have two event first one -running and second - succeeded or failed.&nbsp; How it can be done&nbsp;</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Splunk.PNG" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/17339i29A91FBDA1170A81/image-size/large?v=v2&amp;px=999" role="button" title="Splunk.PNG" alt="Splunk.PNG" /></span></P> Fri, 24 Dec 2021 21:23:11 GMT https://community.splunk.com/t5/Getting-Data-In/Calculate-duration-of-two-different-events/m-p/579248#M102264 rishabhpatel20 2021-12-24T21:23:11Z https://community.splunk.com/t5/Getting-Data-In/Calculate-duration-of-two-different-events/m-p/579250#M102265 <P>The <FONT face="courier new,courier">range</FONT> function should do the job.&nbsp; It computes the difference between the first and last events.</P><LI-CODE lang="markup">index=infra_automation sourcetype=rundeck_execution | stats range(_time) as duration, latest(status) as last_status by job_id | sort - job_id | eval duration = tostring(duration,"duration") | table job_id data time last_status duration</LI-CODE><P>&nbsp;</P> Fri, 24 Dec 2021 22:02:12 GMT https://community.splunk.com/t5/Getting-Data-In/Calculate-duration-of-two-different-events/m-p/579250#M102265 richgalloway 2021-12-24T22:02:12Z https://community.splunk.com/t5/Getting-Data-In/Calculate-duration-of-two-different-events/m-p/579255#M102266 <P>Thanks a lot&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp;.. I was trying with other options like appendcol etc but did not go through the basic one range..&nbsp;</P><P>Thank you !</P> Sat, 25 Dec 2021 10:15:50 GMT https://community.splunk.com/t5/Getting-Data-In/Calculate-duration-of-two-different-events/m-p/579255#M102266 rishabhpatel20 2021-12-25T10:15:50Z