https://community.splunk.com/t5/Splunk-Search/How-to-sort-contiguous-time-into-discreet-sets/m-p/611052#M212480 <P>Assuming your _time fields are already align or binned to the minute and are in ascending order, try something like this:</P><LI-CODE lang="markup">| streamstats range(_time) as previous_gap window=2 | reverse | streamstats range(_time) as next_gap window=2 | where previous_gap != 60 OR next_gap != 60 | streamstats current=f window=1 values(_time) as latest | where next_gap=60 | reverse | rename _time as earliest | fields earliest latest | fieldformat earliest=strftime(earliest,"%F %T") | fieldformat latest=strftime(latest,"%F %T")</LI-CODE> Sat, 27 Aug 2022 14:38:18 GMT ITWhisperer 2022-08-27T14:38:18Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-contiguous-time-into-discreet-sets/m-p/611048#M212478 <P>I'm trying to collapse a of data into earliest/lastest by _time,&nbsp; with the time is contiguous.&nbsp;<BR /><BR />Such as:&nbsp;<BR />2022-08-27 07:36:00<BR />2022-08-27 07:37:00<BR />2022-08-27 07:38:00<BR />2022-08-27 07:39:00<BR />2022-08-27 07:40:00<BR />2022-08-27 07:44:00<BR />2022-08-27 07:45:00<BR />2022-08-27 07:46:00<BR />2022-08-27 08:31:00<BR />2022-08-27 08:32:00<BR />2022-08-27 08:33:00<BR />2022-08-27 08:34:00<BR />2022-08-27 08:35:00<BR /><BR /><BR /><SPAN>earliest:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;latest:</SPAN></P> <P>2022-08-27 07:36:00&nbsp; &nbsp;2022-08-27 07:40:00<BR />2022-08-27 07:44:00&nbsp; &nbsp;2022-08-27 07:46:00<BR />2022-08-27 08:31:00&nbsp; &nbsp;2022-08-27 08:35:00</P> <P>THoughts?&nbsp;</P> Mon, 29 Aug 2022 13:06:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-contiguous-time-into-discreet-sets/m-p/611048#M212478 timgren 2022-08-29T13:06:27Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-contiguous-time-into-discreet-sets/m-p/611052#M212480 <P>Assuming your _time fields are already align or binned to the minute and are in ascending order, try something like this:</P><LI-CODE lang="markup">| streamstats range(_time) as previous_gap window=2 | reverse | streamstats range(_time) as next_gap window=2 | where previous_gap != 60 OR next_gap != 60 | streamstats current=f window=1 values(_time) as latest | where next_gap=60 | reverse | rename _time as earliest | fields earliest latest | fieldformat earliest=strftime(earliest,"%F %T") | fieldformat latest=strftime(latest,"%F %T")</LI-CODE> Sat, 27 Aug 2022 14:38:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-contiguous-time-into-discreet-sets/m-p/611052#M212480 ITWhisperer 2022-08-27T14:38:18Z https://community.splunk.com/t5/Splunk-Search/How-to-sort-contiguous-time-into-discreet-sets/m-p/611055#M212482 <P>Outstanding sir - thank you! I would have never come up with that.&nbsp;<BR /><BR /></P> Sat, 27 Aug 2022 14:51:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sort-contiguous-time-into-discreet-sets/m-p/611055#M212482 timgren 2022-08-27T14:51:45Z