https://community.splunk.com/t5/Splunk-Search/how-to-get-the-average-time-for-latest-event-and-previous-event/m-p/349092#M174599 <P>I am looking for a solution to show for every latest event time and previous event time average duration (and the time span between them). Please help me to get this sorted out ( duration time : 19/06/2017 14:03:23.000 - 19/06/2017 14:03:21.000 = 0.2 min).</P> <P>Latest event:</P> <P>19/06/2017<BR /> 14:03:23.000<BR /><BR /> &lt;[H8C8B5E4487854A2] Request sent</P> <P>Previous Event:</P> <P>19/06/2017<BR /> 14:03:21.000<BR /><BR /> &lt;[H8C8B5E4487854A2] Request sent</P> Mon, 19 Jun 2017 06:14:57 GMT remoharish 2017-06-19T06:14:57Z https://community.splunk.com/t5/Splunk-Search/how-to-get-the-average-time-for-latest-event-and-previous-event/m-p/349092#M174599 <P>I am looking for a solution to show for every latest event time and previous event time average duration (and the time span between them). Please help me to get this sorted out ( duration time : 19/06/2017 14:03:23.000 - 19/06/2017 14:03:21.000 = 0.2 min).</P> <P>Latest event:</P> <P>19/06/2017<BR /> 14:03:23.000<BR /><BR /> &lt;[H8C8B5E4487854A2] Request sent</P> <P>Previous Event:</P> <P>19/06/2017<BR /> 14:03:21.000<BR /><BR /> &lt;[H8C8B5E4487854A2] Request sent</P> Mon, 19 Jun 2017 06:14:57 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-the-average-time-for-latest-event-and-previous-event/m-p/349092#M174599 remoharish 2017-06-19T06:14:57Z https://community.splunk.com/t5/Splunk-Search/how-to-get-the-average-time-for-latest-event-and-previous-event/m-p/349093#M174600 <P>use streamstats. <A href="http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Streamstats">http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Streamstats</A></P> <P>something like this:</P> <PRE><CODE>...|sort 0 transaction _time |streamstats window=1 current=f values(_time) as prevTime count as order by transaction |eval deltaTime=_time-prevTime |eval avgTime=(_time+prevTime)/2 |eventstats max(order) as maxOrder by transaction |where maxOrder=order </CODE></PRE> Mon, 19 Jun 2017 11:40:33 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-the-average-time-for-latest-event-and-previous-event/m-p/349093#M174600 cmerriman 2017-06-19T11:40:33Z