https://community.splunk.com/t5/Getting-Data-In/How-to-find-the-time-difference-between-values-in-the-same-field/m-p/253791#M48712 <P>It worked! Thank you</P> Mon, 25 Jan 2016 22:13:43 GMT raby1996 2016-01-25T22:13:43Z https://community.splunk.com/t5/Getting-Data-In/How-to-find-the-time-difference-between-values-in-the-same-field/m-p/253789#M48710 <P>Hi all,<BR /> I have a field that i am calling "code_load_date" and I am running a stats command that groups them by associated serial number and code level, so essentially the events look like this-</P> <PRE><CODE>Serial Code code_load_date 8k12 1.1 1/01/15 -------------------------------------------------------------------- 8k13 1.2 01/01/15 1.3 01/11/15 1.4 01/22/15 -------------------------------------------------------------------- 8k14 1.2 01/01/15 1.3 01/15/15 </CODE></PRE> <P>and essentially I want to find the difference in the days between each date (code_load_date) that code was loaded onto a machine (serial) between each new code level so my desired results would look something like this-</P> <PRE><CODE> Serial Code code_load_date time_difference 8k12 1.1 1/01/15 0 --------------------------------- 8k13 1.2 01/01/15 10 1.3 01/11/15 11 1.4 01/22/15 -------------------------------- 8k14 1.2 01/01/15 14 1.3 01/15/15 </CODE></PRE> <P>Is there any way that this can be achieved? Thank you in advance.</P> Tue, 29 Sep 2020 08:35:19 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-find-the-time-difference-between-values-in-the-same-field/m-p/253789#M48710 raby1996 2020-09-29T08:35:19Z https://community.splunk.com/t5/Getting-Data-In/How-to-find-the-time-difference-between-values-in-the-same-field/m-p/253790#M48711 <P>I'm guessing your query looks like this</P> <PRE><CODE>your search before stats | stats values(Code) as Code values(code_load_date) as code_load_date by Serial </CODE></PRE> <P>Try something like this</P> <PRE><CODE>your search before stats | sort Serial code_load_date | streamstats current=f window=1 values(code_load_date) as prev by Serial | eval time_diff=round(strptime(code_load_date,"%m/%d/%y")-strptime(prev,"%m/%d/%y"))/86400) | stats values(Code) as Code values(code_load_date) as code_load_date values(time_difference) as time_difference by Serial | fillnull value=0 time_difference </CODE></PRE> Mon, 25 Jan 2016 21:49:37 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-find-the-time-difference-between-values-in-the-same-field/m-p/253790#M48711 somesoni2 2016-01-25T21:49:37Z https://community.splunk.com/t5/Getting-Data-In/How-to-find-the-time-difference-between-values-in-the-same-field/m-p/253791#M48712 <P>It worked! Thank you</P> Mon, 25 Jan 2016 22:13:43 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-find-the-time-difference-between-values-in-the-same-field/m-p/253791#M48712 raby1996 2016-01-25T22:13:43Z