https://community.splunk.com/t5/Splunk-Search/Find-Difference-between-multiple-events/m-p/463094#M130550 <P>You should be able to do that with <CODE>stats</CODE>. First, convert the timestamp field into epoch form so the difference can be computed.</P> <PRE><CODE>... | eval ts=strptime(timestamp, "%Y-%m-%d %H:%M:%S.%3N") | stats range(ts) by TransID AppName </CODE></PRE> Tue, 17 Dec 2019 13:12:39 GMT richgalloway 2019-12-17T13:12:39Z https://community.splunk.com/t5/Splunk-Search/Find-Difference-between-multiple-events/m-p/463093#M130549 <P>TransID AppName timestamp Messagge<BR /> 1 App1 2019-12-16 18:18:43.731 +0000 Message……<BR /> 1 App1 2019-12-16 18:18:43.732 +0000 Before call: 1<BR /> 1 App2 2019-12-16 18:18:43.743 +0000 Message…..<BR /> 1 App2 2019-12-16 18:18:43.745 +0000 Message…..<BR /> 1 App1 2019-12-16 18:18:43.807 +0000 After Call: 1<BR /> 1 App1 2019-12-16 18:18:43.809 +0000 Message………<BR /> 2 App1 2019-12-16 18:22:37.720 +0000 Message……<BR /> 2 App1 2019-12-16 18:22:37.724 +0000 Before call: 2<BR /> 2 App2 2019-12-16 18:22:37.755 +0000 Message…..<BR /> 2 App2 2019-12-16 18:22:37.760 +0000 Message…..<BR /> 2 App1 2019-12-16 18:22:37.820 +0000 After Call: 2<BR /> 2 App1 2019-12-16 18:22:37.822 +0000 Message………</P> <P>I have data in above format and I want to get the output as a report which shows how much time each AppName takes to process a tarnsaction. in below format:</P> <P>TransID App1 App2 ....<BR /> 1 0.002 0.002 ....<BR /> 2 0.006 0.005 ...</P> <P>I tried using transaction command but it gives me the duration based on the first and last event. but In my case I need how much time a transaction was in a particular app?</P> <P>Thanks.</P> Tue, 17 Dec 2019 09:29:11 GMT https://community.splunk.com/t5/Splunk-Search/Find-Difference-between-multiple-events/m-p/463093#M130549 rkmaggidi 2019-12-17T09:29:11Z https://community.splunk.com/t5/Splunk-Search/Find-Difference-between-multiple-events/m-p/463094#M130550 <P>You should be able to do that with <CODE>stats</CODE>. First, convert the timestamp field into epoch form so the difference can be computed.</P> <PRE><CODE>... | eval ts=strptime(timestamp, "%Y-%m-%d %H:%M:%S.%3N") | stats range(ts) by TransID AppName </CODE></PRE> Tue, 17 Dec 2019 13:12:39 GMT https://community.splunk.com/t5/Splunk-Search/Find-Difference-between-multiple-events/m-p/463094#M130550 richgalloway 2019-12-17T13:12:39Z https://community.splunk.com/t5/Splunk-Search/Find-Difference-between-multiple-events/m-p/463095#M130551 <P>Thanks it worked <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 23 Jan 2020 10:39:43 GMT https://community.splunk.com/t5/Splunk-Search/Find-Difference-between-multiple-events/m-p/463095#M130551 rkmaggidi 2020-01-23T10:39:43Z