https://community.splunk.com/t5/Splunk-Search/Calculate-Lag-time-between-events/m-p/529273#M149457 <LI-CODE lang="markup">| autoregress field1 as previous1 p=1 | eval diff=field1-previous1</LI-CODE> Fri, 13 Nov 2020 09:35:05 GMT ITWhisperer 2020-11-13T09:35:05Z https://community.splunk.com/t5/Splunk-Search/Calculate-Lag-time-between-events/m-p/529270#M149454 <P>I am trying to calculate lag time but have the following issues:</P><P>_time is the same for each event as the data is indexed in chunks.</P><P>I am&nbsp;<SPAN>trying to take the highest result from field access-time and calculate the difference between the second highest result.</SPAN></P><P><SPAN>Something like |eval resultA - resultB.&nbsp; How do I get the 2 latest results from field access-time and calculate the difference</SPAN></P><TABLE width="273px"><TBODY><TR><TD width="165.333px">2020-11-13 08:18:37</TD><TD width="106.667px">1605254674</TD></TR><TR><TD width="165.333px">2020-11-13 08:18:37</TD><TD width="106.667px">1605254590</TD></TR><TR><TD width="165.333px">2020-11-13 08:18:37</TD><TD width="106.667px">1605253080</TD></TR><TR><TD width="165.333px">2020-11-13 08:18:37</TD><TD width="106.667px">1605252671</TD></TR><TR><TD width="165.333px">2020-11-13 08:18:37</TD><TD width="106.667px">1605251083</TD></TR><TR><TD width="165.333px">2020-11-13 08:18:37</TD><TD width="106.667px">1605250993</TD></TR><TR><TD width="165.333px">2020-11-13 08:18:37</TD><TD width="106.667px">1605249063</TD></TR><TR><TD width="165.333px">2020-11-13 08:18:37</TD><TD width="106.667px">1605247382</TD></TR><TR><TD width="165.333px">2020-11-13 08:18:37</TD><TD width="106.667px">1605245462</TD></TR><TR><TD width="165.333px">2020-11-13 08:18:37</TD><TD width="106.667px">1605243784</TD></TR><TR><TD width="165.333px">2020-11-13 08:18:37</TD><TD width="106.667px">1605241862</TD></TR><TR><TD width="165.333px">2020-11-13 08:18:37</TD><TD width="106.667px">1605240185</TD></TR><TR><TD width="165.333px">2020-11-13 08:18:37</TD><TD width="106.667px">1605238263</TD></TR><TR><TD width="165.333px">2020-11-13 08:18:37</TD><TD width="106.667px">1605236583</TD></TR><TR><TD width="165.333px">2020-11-13 08:18:37</TD><TD width="106.667px">1605234662</TD></TR><TR><TD width="165.333px">2020-11-13 08:18:37</TD><TD width="106.667px">1605232983</TD></TR><TR><TD width="165.333px">2020-11-13 08:18:37</TD><TD width="106.667px">1605231063</TD></TR><TR><TD width="165.333px">2020-11-13 08:18:37</TD><TD width="106.667px">1605229384</TD></TR><TR><TD width="165.333px">2020-11-13 08:18:37</TD><TD width="106.667px">1605227467</TD></TR><TR><TD width="165.333px">2020-11-13 08:18:37</TD><TD width="106.667px">1605225783</TD></TR><TR><TD width="165.333px">2020-11-13 08:18:37</TD><TD width="106.667px">1605223863</TD></TR><TR><TD width="165.333px">2020-11-13 08:18:37</TD><TD width="106.667px">1605222196</TD></TR><TR><TD width="165.333px">2020-11-13 08:18:37</TD><TD width="106.667px">1605220274</TD></TR><TR><TD width="165.333px">2020-11-13 08:18:37</TD><TD width="106.667px">1605218605</TD></TR><TR><TD width="165.333px">2020-11-13 08:18:37</TD><TD width="106.667px">1605216684</TD></TR><TR><TD width="165.333px">2020-11-13 08:18:37</TD><TD width="106.667px">1605214996</TD></TR></TBODY></TABLE> Fri, 13 Nov 2020 09:24:53 GMT https://community.splunk.com/t5/Splunk-Search/Calculate-Lag-time-between-events/m-p/529270#M149454 parmenion_natha 2020-11-13T09:24:53Z https://community.splunk.com/t5/Splunk-Search/Calculate-Lag-time-between-events/m-p/529273#M149457 <LI-CODE lang="markup">| autoregress field1 as previous1 p=1 | eval diff=field1-previous1</LI-CODE> Fri, 13 Nov 2020 09:35:05 GMT https://community.splunk.com/t5/Splunk-Search/Calculate-Lag-time-between-events/m-p/529273#M149457 ITWhisperer 2020-11-13T09:35:05Z