https://community.splunk.com/t5/Splunk-Enterprise-Security/Using-the-eval-command-how-do-you-calculate-the-time-difference/m-p/379329#M3831 <P>Hi,</P> <P>There's probably a better function to use for this, but I think it could be done with an eval and where (I think anyway)...</P> <P>I need to calculate the time difference between two events WHERE the status value is different. i.e;</P> <PRE><CODE>event details status _time event 1 2 2019-03-25 00:01:00 event 2 3 2019-03-25 00:31:00 </CODE></PRE> <P>I tried this, but it failed;</P> <PRE><CODE>| eval time1=_time(where (like status="2") </CODE></PRE> <P>any ideas?</P> Mon, 25 Mar 2019 14:43:02 GMT jacqu3sy 2019-03-25T14:43:02Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Using-the-eval-command-how-do-you-calculate-the-time-difference/m-p/379329#M3831 <P>Hi,</P> <P>There's probably a better function to use for this, but I think it could be done with an eval and where (I think anyway)...</P> <P>I need to calculate the time difference between two events WHERE the status value is different. i.e;</P> <PRE><CODE>event details status _time event 1 2 2019-03-25 00:01:00 event 2 3 2019-03-25 00:31:00 </CODE></PRE> <P>I tried this, but it failed;</P> <PRE><CODE>| eval time1=_time(where (like status="2") </CODE></PRE> <P>any ideas?</P> Mon, 25 Mar 2019 14:43:02 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Using-the-eval-command-how-do-you-calculate-the-time-difference/m-p/379329#M3831 jacqu3sy 2019-03-25T14:43:02Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Using-the-eval-command-how-do-you-calculate-the-time-difference/m-p/379330#M3832 <P>If there is something common between the events like a <CODE>transaction_id</CODE> you can use the 'transaction' statement, which calculates you a duration in ms.<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/Transaction">https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/Transaction</A></P> <PRE><CODE>...your search| transaction tx_id |eval dur_sec=round((duration/1000) ,0) </CODE></PRE> <P>If you provide some more relevent data I can expand my example to fit your use case.</P> Mon, 25 Mar 2019 14:51:34 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Using-the-eval-command-how-do-you-calculate-the-time-difference/m-p/379330#M3832 nickhills 2019-03-25T14:51:34Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Using-the-eval-command-how-do-you-calculate-the-time-difference/m-p/379331#M3833 <P>I didnt think about 'transaction', I'll take a look at that. Regarding data, I'm using the rule_id of an event taken from the enterprise security macro 'incident_review', which is common between the two events;</P> <P>rule_id status AssignementTime<BR /> 0FF72D78 2 1552985974.388964<BR /> 0FF72D78 3 1552986403.234565</P> Tue, 29 Sep 2020 23:51:53 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Using-the-eval-command-how-do-you-calculate-the-time-difference/m-p/379331#M3833 jacqu3sy 2020-09-29T23:51:53Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Using-the-eval-command-how-do-you-calculate-the-time-difference/m-p/379332#M3834 <P>Great, just try swapping 'tx_id' for 'rule_id' and see how that fits your needs.<BR /> Good luck!</P> Tue, 29 Sep 2020 23:51:58 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Using-the-eval-command-how-do-you-calculate-the-time-difference/m-p/379332#M3834 nickhills 2020-09-29T23:51:58Z