https://community.splunk.com/t5/Getting-Data-In/Joining-two-Sequential-Time-Events-into-one-Event-in-Splunk-if/m-p/328674#M60990 <P>Hi All,</P> <P>I got out put like this </P> <PRE><CODE> From date Todate </CODE></PRE> <P>03/02/2018 09:41:26 <STRONG>03/02/2018 12:55:52</STRONG><BR /> <STRONG>03/02/2018 12:55:53</STRONG> 03/02/2018 14:00:00</P> <P>But there is no -difference which is in Bold so I want output like this </P> <PRE><CODE> From date Todate </CODE></PRE> <P>03/02/2018 09:41:26 03/02/2018 14:00:00</P> Sat, 03 Mar 2018 09:36:19 GMT ajayabburi508 2018-03-03T09:36:19Z https://community.splunk.com/t5/Getting-Data-In/Joining-two-Sequential-Time-Events-into-one-Event-in-Splunk-if/m-p/328674#M60990 <P>Hi All,</P> <P>I got out put like this </P> <PRE><CODE> From date Todate </CODE></PRE> <P>03/02/2018 09:41:26 <STRONG>03/02/2018 12:55:52</STRONG><BR /> <STRONG>03/02/2018 12:55:53</STRONG> 03/02/2018 14:00:00</P> <P>But there is no -difference which is in Bold so I want output like this </P> <PRE><CODE> From date Todate </CODE></PRE> <P>03/02/2018 09:41:26 03/02/2018 14:00:00</P> Sat, 03 Mar 2018 09:36:19 GMT https://community.splunk.com/t5/Getting-Data-In/Joining-two-Sequential-Time-Events-into-one-Event-in-Splunk-if/m-p/328674#M60990 ajayabburi508 2018-03-03T09:36:19Z https://community.splunk.com/t5/Getting-Data-In/Joining-two-Sequential-Time-Events-into-one-Event-in-Splunk-if/m-p/328675#M60991 <P>have a look at transaction command:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Transaction">https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Transaction</A></P> Sat, 03 Mar 2018 10:04:29 GMT https://community.splunk.com/t5/Getting-Data-In/Joining-two-Sequential-Time-Events-into-one-Event-in-Splunk-if/m-p/328675#M60991 493669 2018-03-03T10:04:29Z