https://community.splunk.com/t5/Getting-Data-In/How-calculate-the-delta-between-the-timestamp-in-one-row-with/m-p/211367#M41604 <P>Have you considered the Delta command?</P> <PRE><CODE>[your search] | delta _time as OnSince | eval OnSince = tostring (OnSince, "duration") </CODE></PRE> Tue, 23 Feb 2016 16:34:39 GMT Stevelim 2016-02-23T16:34:39Z https://community.splunk.com/t5/Getting-Data-In/How-calculate-the-delta-between-the-timestamp-in-one-row-with/m-p/211366#M41603 <P>Hi,</P> <P>In my search result, I have a series of events. I am able to calculate the delta of the various _time timestamps between each event, but how can I calculate the delta dividing the result in pairs? For example, I have 6 timestamps:</P> <PRE><CODE>1 - 22/02/16 14:50:00.000 2 - 22/02/16 14:50:30.000 3 - 22/02/16 14:50:38.000 4 - 22/02/16 14:50:59.000 5 - 22/02/16 14:53:06.000 6 - 22/02/16 14:54:00.000 ... </CODE></PRE> <P>I need the delta between line 1 and line 2, then between line 3 and line 4, and so on for the entire result. Someone knows how to do something like this?</P> Tue, 23 Feb 2016 12:52:11 GMT https://community.splunk.com/t5/Getting-Data-In/How-calculate-the-delta-between-the-timestamp-in-one-row-with/m-p/211366#M41603 Brigno 2016-02-23T12:52:11Z https://community.splunk.com/t5/Getting-Data-In/How-calculate-the-delta-between-the-timestamp-in-one-row-with/m-p/211367#M41604 <P>Have you considered the Delta command?</P> <PRE><CODE>[your search] | delta _time as OnSince | eval OnSince = tostring (OnSince, "duration") </CODE></PRE> Tue, 23 Feb 2016 16:34:39 GMT https://community.splunk.com/t5/Getting-Data-In/How-calculate-the-delta-between-the-timestamp-in-one-row-with/m-p/211367#M41604 Stevelim 2016-02-23T16:34:39Z https://community.splunk.com/t5/Getting-Data-In/How-calculate-the-delta-between-the-timestamp-in-one-row-with/m-p/211368#M41605 <P>Yes, I do. I know it, but it's not what I'm looking for. That command make a delta between line 1-2, 2-3, 3-4. 4-5 and so on, but what I really need is a delta between lines 1-2, 3-4, 5-6 etc.</P> Tue, 23 Feb 2016 20:47:46 GMT https://community.splunk.com/t5/Getting-Data-In/How-calculate-the-delta-between-the-timestamp-in-one-row-with/m-p/211368#M41605 Brigno 2016-02-23T20:47:46Z https://community.splunk.com/t5/Getting-Data-In/How-calculate-the-delta-between-the-timestamp-in-one-row-with/m-p/211369#M41606 <P>Like this:</P> <PRE><CODE>Your Base Search Here | streamstats count AS serial | eval copy_time=if(serial%2==1, _time, null()) | streamstats current=f last(copy_time) AS last_time | eval delta = if(isnull(copy_time), tostring(last_time - _time, "duration"), null()) </CODE></PRE> Fri, 04 May 2018 06:24:03 GMT https://community.splunk.com/t5/Getting-Data-In/How-calculate-the-delta-between-the-timestamp-in-one-row-with/m-p/211369#M41606 woodcock 2018-05-04T06:24:03Z