https://community.splunk.com/t5/Splunk-Search/How-to-check-since-how-long-the-field-is-having-null-value/m-p/496813#M138422 <P>Try this:</P> <PRE><CODE>index=&lt;index_name&gt; NOT TPP_ID=* | stats earliest(_time) as et latest(_time) as lt | eval time_diff = lt - et </CODE></PRE> Tue, 28 Jan 2020 14:20:43 GMT manjunathmeti 2020-01-28T14:20:43Z https://community.splunk.com/t5/Splunk-Search/How-to-check-since-how-long-the-field-is-having-null-value/m-p/496812#M138421 <P>I want to check for how long my field TPP_ID is empty. I want to check date and time. Is it possible using splunk query?</P> Tue, 28 Jan 2020 10:13:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-check-since-how-long-the-field-is-having-null-value/m-p/496812#M138421 493600 2020-01-28T10:13:10Z https://community.splunk.com/t5/Splunk-Search/How-to-check-since-how-long-the-field-is-having-null-value/m-p/496813#M138422 <P>Try this:</P> <PRE><CODE>index=&lt;index_name&gt; NOT TPP_ID=* | stats earliest(_time) as et latest(_time) as lt | eval time_diff = lt - et </CODE></PRE> Tue, 28 Jan 2020 14:20:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-check-since-how-long-the-field-is-having-null-value/m-p/496813#M138422 manjunathmeti 2020-01-28T14:20:43Z