https://community.splunk.com/t5/Splunk-Search/How-to-list-with-events-time-difference-greater-than-0-5-secs/m-p/590318#M205525 <P>How do I list those events within a set of events(say expand the below query) wherein say 2 consecutive's event time difference is more than 0.5 secs?</P> <P>index=index1 * "orderid"</P> <P>&nbsp;</P> <P>thank you</P> Wed, 23 Mar 2022 06:36:33 GMT msg4sunil 2022-03-23T06:36:33Z https://community.splunk.com/t5/Splunk-Search/How-to-list-with-events-time-difference-greater-than-0-5-secs/m-p/590318#M205525 <P>How do I list those events within a set of events(say expand the below query) wherein say 2 consecutive's event time difference is more than 0.5 secs?</P> <P>index=index1 * "orderid"</P> <P>&nbsp;</P> <P>thank you</P> Wed, 23 Mar 2022 06:36:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-list-with-events-time-difference-greater-than-0-5-secs/m-p/590318#M205525 msg4sunil 2022-03-23T06:36:33Z https://community.splunk.com/t5/Splunk-Search/How-to-list-with-events-time-difference-greater-than-0-5-secs/m-p/590319#M205526 <P>Simple example here</P><LI-CODE lang="markup">index=index1 * "orderid" | delta _time as timeDiff | where timeDiff &lt; -0.5</LI-CODE><P>That is simply selecting events where the earlier event is more than 0.5 seconds before the current event, but not sure if that's exactly what you're after</P> Wed, 23 Mar 2022 04:12:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-list-with-events-time-difference-greater-than-0-5-secs/m-p/590319#M205526 bowesmana 2022-03-23T04:12:54Z https://community.splunk.com/t5/Splunk-Search/How-to-list-with-events-time-difference-greater-than-0-5-secs/m-p/590327#M205536 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/6367">@bowesmana</a>&nbsp;, lovely thanks a lot!</P> Wed, 23 Mar 2022 05:09:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-list-with-events-time-difference-greater-than-0-5-secs/m-p/590327#M205536 msg4sunil 2022-03-23T05:09:28Z