https://community.splunk.com/t5/Splunk-Search/calculate-min-and-max-time-of-event/m-p/462693#M191464 <P>Why don't you try using a command other than <CODE>transaction</CODE> ?<BR /> or extract <CODE>_time</CODE> by using <CODE>rex</CODE> again. </P> Wed, 27 May 2020 09:27:48 GMT to4kawa 2020-05-27T09:27:48Z https://community.splunk.com/t5/Splunk-Search/calculate-min-and-max-time-of-event/m-p/462690#M191461 <P>hello<BR /> im trying to calculate min and max time of event (the time when the event started and when its ended)<BR /> when im adding my calculation to the query im loosing the results of the rest of the query and getting only the result of the time calculation... <BR /> what am i missing ?</P> <PRE><CODE>index=prod eventtype="csm-messages-dhcpd-lpf-eth0-listening" OR eventtype="csm-messages-dhcpd-lpf-eth0-sending" OR eventtype="csm-messages-dhcpd-send-socket-fallback-net" OR eventtype="csm-messages-dhcpd-write-zero-leases" OR eventtype="csm-messages-dhcpd-eth1-nosubnet-declared" | transaction maxpause=2s maxspan=1s maxevents=5 | stats first(_time) as min_time, last(_time) as max_time | table _time,eventcount, eventtype, tail_id, kafka_uuid,min_time,max_time | foreach eventtype [eval flag_eventtype=if(eventcount!=5,"no", "yes")] </CODE></PRE> Wed, 27 May 2020 08:21:57 GMT https://community.splunk.com/t5/Splunk-Search/calculate-min-and-max-time-of-event/m-p/462690#M191461 sarit_s 2020-05-27T08:21:57Z https://community.splunk.com/t5/Splunk-Search/calculate-min-and-max-time-of-event/m-p/462691#M191462 <P><CODE>transaction</CODE> has only one <CODE>_time</CODE></P> Wed, 27 May 2020 09:12:37 GMT https://community.splunk.com/t5/Splunk-Search/calculate-min-and-max-time-of-event/m-p/462691#M191462 to4kawa 2020-05-27T09:12:37Z https://community.splunk.com/t5/Splunk-Search/calculate-min-and-max-time-of-event/m-p/462692#M191463 <P>so i can i do it differently ?</P> Wed, 27 May 2020 09:24:26 GMT https://community.splunk.com/t5/Splunk-Search/calculate-min-and-max-time-of-event/m-p/462692#M191463 sarit_s 2020-05-27T09:24:26Z https://community.splunk.com/t5/Splunk-Search/calculate-min-and-max-time-of-event/m-p/462693#M191464 <P>Why don't you try using a command other than <CODE>transaction</CODE> ?<BR /> or extract <CODE>_time</CODE> by using <CODE>rex</CODE> again. </P> Wed, 27 May 2020 09:27:48 GMT https://community.splunk.com/t5/Splunk-Search/calculate-min-and-max-time-of-event/m-p/462693#M191464 to4kawa 2020-05-27T09:27:48Z https://community.splunk.com/t5/Splunk-Search/calculate-min-and-max-time-of-event/m-p/462694#M191465 <P>im open to try, i just don't know what and how <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 27 May 2020 09:31:05 GMT https://community.splunk.com/t5/Splunk-Search/calculate-min-and-max-time-of-event/m-p/462694#M191465 sarit_s 2020-05-27T09:31:05Z https://community.splunk.com/t5/Splunk-Search/calculate-min-and-max-time-of-event/m-p/462695#M191466 <P>check reference:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/latest/Search/Abouteventcorrelation">https://docs.splunk.com/Documentation/Splunk/latest/Search/Abouteventcorrelation</A></P> Wed, 27 May 2020 09:39:24 GMT https://community.splunk.com/t5/Splunk-Search/calculate-min-and-max-time-of-event/m-p/462695#M191466 to4kawa 2020-05-27T09:39:24Z https://community.splunk.com/t5/Splunk-Search/calculate-min-and-max-time-of-event/m-p/462696#M191467 <P>it looks like using transaction is the right way.. so how can i use rex to extract _time ?</P> Wed, 27 May 2020 09:52:55 GMT https://community.splunk.com/t5/Splunk-Search/calculate-min-and-max-time-of-event/m-p/462696#M191467 sarit_s 2020-05-27T09:52:55Z https://community.splunk.com/t5/Splunk-Search/calculate-min-and-max-time-of-event/m-p/462697#M191468 <P>I don't know, check your log.</P> Wed, 27 May 2020 10:29:02 GMT https://community.splunk.com/t5/Splunk-Search/calculate-min-and-max-time-of-event/m-p/462697#M191468 to4kawa 2020-05-27T10:29:02Z