https://community.splunk.com/t5/Splunk-Search/How-can-I-get-Streamstats-to-Calculate-all-Fields/m-p/391590#M168745 <P>I am using the following search which returns a table with three rows:</P> <PRE><CODE> | streamstats current=f last(_time) as NewTime first(_time) as LastTask by Item | eval Duration=NewTime-_time | eval RunTime=(Duration/60) | table JobName, RunTime, _time </CODE></PRE> <P>The issue I am having is that my time is only caluculated for two of the rows, the earliest two. The final record is not calculating a time so I am getting the following:</P> <P>JobName,RunTime, _time<BR /> Name1, ,5:00<BR /> Name2,120,4:00<BR /> Name3,60,2:00</P> <P>Is there a way I can force it to calculate the final time?</P> Thu, 21 Jun 2018 17:11:25 GMT aohls 2018-06-21T17:11:25Z https://community.splunk.com/t5/Splunk-Search/How-can-I-get-Streamstats-to-Calculate-all-Fields/m-p/391590#M168745 <P>I am using the following search which returns a table with three rows:</P> <PRE><CODE> | streamstats current=f last(_time) as NewTime first(_time) as LastTask by Item | eval Duration=NewTime-_time | eval RunTime=(Duration/60) | table JobName, RunTime, _time </CODE></PRE> <P>The issue I am having is that my time is only caluculated for two of the rows, the earliest two. The final record is not calculating a time so I am getting the following:</P> <P>JobName,RunTime, _time<BR /> Name1, ,5:00<BR /> Name2,120,4:00<BR /> Name3,60,2:00</P> <P>Is there a way I can force it to calculate the final time?</P> Thu, 21 Jun 2018 17:11:25 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-Streamstats-to-Calculate-all-Fields/m-p/391590#M168745 aohls 2018-06-21T17:11:25Z https://community.splunk.com/t5/Splunk-Search/How-can-I-get-Streamstats-to-Calculate-all-Fields/m-p/391591#M168746 <P>The problem is that there is no last(_time) for row appearing first in result (would be the last result if sorted by _time), hence no calculation is done. What should the RunTime value for it?</P> Thu, 21 Jun 2018 18:07:53 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-Streamstats-to-Calculate-all-Fields/m-p/391591#M168746 somesoni2 2018-06-21T18:07:53Z