https://community.splunk.com/t5/Splunk-Search/mulitvalue-and-single-value-difference/m-p/671527#M230122 <P>How to get difference of&nbsp; lastest value with now i have multiple values in latest column and only one value in now column i want output as difference&nbsp;<BR /><BR /></P><TABLE width="287"><TBODY><TR><TD width="195">latest</TD><TD width="92">now</TD></TR><TR><TD width="195">1701973800.000000<BR />1701455400.000000<BR />1701455400.000000<BR />1700418600.000000<BR />1700418600.000000</TD><TD>1702372339</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>1701973800.000000-&nbsp;1702372339 =</P><P>1701455400.000000-&nbsp;1702372339=&nbsp;</P><P>like this&nbsp;</P> Tue, 12 Dec 2023 09:16:55 GMT nehamvinchankar 2023-12-12T09:16:55Z https://community.splunk.com/t5/Splunk-Search/mulitvalue-and-single-value-difference/m-p/671527#M230122 <P>How to get difference of&nbsp; lastest value with now i have multiple values in latest column and only one value in now column i want output as difference&nbsp;<BR /><BR /></P><TABLE width="287"><TBODY><TR><TD width="195">latest</TD><TD width="92">now</TD></TR><TR><TD width="195">1701973800.000000<BR />1701455400.000000<BR />1701455400.000000<BR />1700418600.000000<BR />1700418600.000000</TD><TD>1702372339</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>1701973800.000000-&nbsp;1702372339 =</P><P>1701455400.000000-&nbsp;1702372339=&nbsp;</P><P>like this&nbsp;</P> Tue, 12 Dec 2023 09:16:55 GMT https://community.splunk.com/t5/Splunk-Search/mulitvalue-and-single-value-difference/m-p/671527#M230122 nehamvinchankar 2023-12-12T09:16:55Z https://community.splunk.com/t5/Splunk-Search/mulitvalue-and-single-value-difference/m-p/671538#M230123 <LI-CODE lang="markup">| mvexpand latest | eval diff=now - latest</LI-CODE> Tue, 12 Dec 2023 11:04:33 GMT https://community.splunk.com/t5/Splunk-Search/mulitvalue-and-single-value-difference/m-p/671538#M230123 ITWhisperer 2023-12-12T11:04:33Z