https://community.splunk.com/t5/Splunk-Search/Find-time-between-first-and-second-events-grouped-efficiently/m-p/91462#M23536 <P>Hi,</P> <P>I am getting events in the form of:</P> <P>__time, app_name, action,udid</P> <P>"2013-04-11 23:26:32","nxTomo HK V0.9","game_start","1234"</P> <P>I wish to group them by udid and find the time in seconds between the first and second event,<BR /> even if there are more than 2 events in an group.<BR /> The rest of the events should be ignored.</P> <P>Can someone help me do this efficiently?</P> Mon, 28 Sep 2020 13:43:08 GMT noambz 2020-09-28T13:43:08Z https://community.splunk.com/t5/Splunk-Search/Find-time-between-first-and-second-events-grouped-efficiently/m-p/91462#M23536 <P>Hi,</P> <P>I am getting events in the form of:</P> <P>__time, app_name, action,udid</P> <P>"2013-04-11 23:26:32","nxTomo HK V0.9","game_start","1234"</P> <P>I wish to group them by udid and find the time in seconds between the first and second event,<BR /> even if there are more than 2 events in an group.<BR /> The rest of the events should be ignored.</P> <P>Can someone help me do this efficiently?</P> Mon, 28 Sep 2020 13:43:08 GMT https://community.splunk.com/t5/Splunk-Search/Find-time-between-first-and-second-events-grouped-efficiently/m-p/91462#M23536 noambz 2020-09-28T13:43:08Z https://community.splunk.com/t5/Splunk-Search/Find-time-between-first-and-second-events-grouped-efficiently/m-p/91463#M23537 <P>Hi, I think Example 6 here is what you want... <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Eval#Example_6">http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Eval#Example_6</A></P> Fri, 12 Apr 2013 00:53:21 GMT https://community.splunk.com/t5/Splunk-Search/Find-time-between-first-and-second-events-grouped-efficiently/m-p/91463#M23537 jcoates_splunk 2013-04-12T00:53:21Z https://community.splunk.com/t5/Splunk-Search/Find-time-between-first-and-second-events-grouped-efficiently/m-p/91464#M23538 <P>Not exactly. </P> <P>Let's say I have 3 app starts. They will all be grouped together and the duration will measure the time between the 1st and 3rd.</P> <P>If I use maxevents=2. Then the other event will be in a separate group which needs to be discarded somehow.</P> Fri, 12 Apr 2013 01:02:36 GMT https://community.splunk.com/t5/Splunk-Search/Find-time-between-first-and-second-events-grouped-efficiently/m-p/91464#M23538 noambz 2013-04-12T01:02:36Z https://community.splunk.com/t5/Splunk-Search/Find-time-between-first-and-second-events-grouped-efficiently/m-p/91465#M23539 <P>I tried this and it seems to work.</P> <P>action=app_start | streamstats avg(_time) as prevendtime window=1 current=f global=false by udid | eval timegapsecs=abs(round(_time - prevendtime,0)) | reverse | dedup 1 udid</P> <P>Can anyone comment on the efficiency or correctness of this?</P> Mon, 28 Sep 2020 13:43:16 GMT https://community.splunk.com/t5/Splunk-Search/Find-time-between-first-and-second-events-grouped-efficiently/m-p/91465#M23539 noambz 2020-09-28T13:43:16Z