https://community.splunk.com/t5/Splunk-Search/Work-out-the-duration-between-two-fields/m-p/170478#M48774 <P>Hi there.<BR /> I basically have a data set with Support Cases in, i would like to find out the duration between the case being created (New) and the case being closed (Resolved).</P> <P>I have tried using eval/transaction and just cant get it to work.<BR /> can anyone help? <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span><BR /> Thanks</P> Fri, 01 May 2015 15:23:14 GMT gracemaher 2015-05-01T15:23:14Z https://community.splunk.com/t5/Splunk-Search/Work-out-the-duration-between-two-fields/m-p/170478#M48774 <P>Hi there.<BR /> I basically have a data set with Support Cases in, i would like to find out the duration between the case being created (New) and the case being closed (Resolved).</P> <P>I have tried using eval/transaction and just cant get it to work.<BR /> can anyone help? <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span><BR /> Thanks</P> Fri, 01 May 2015 15:23:14 GMT https://community.splunk.com/t5/Splunk-Search/Work-out-the-duration-between-two-fields/m-p/170478#M48774 gracemaher 2015-05-01T15:23:14Z https://community.splunk.com/t5/Splunk-Search/Work-out-the-duration-between-two-fields/m-p/170479#M48775 <P>Let's say the field that you were using in your transaction command is "CorrelationField" then this should work:<BR /> <PRE><BR /> ... | stats earliest(_time) AS first latest(_time) AS last by CorrelationField | eval duration=last-first<BR /> </PRE> </P> Mon, 28 Sep 2020 19:48:48 GMT https://community.splunk.com/t5/Splunk-Search/Work-out-the-duration-between-two-fields/m-p/170479#M48775 woodcock 2020-09-28T19:48:48Z https://community.splunk.com/t5/Splunk-Search/Work-out-the-duration-between-two-fields/m-p/170480#M48776 <P>try </P> <PRE><CODE>...| transaction Field_name startswith="New" endswith="Resolved"|eval duration = duration|... </CODE></PRE> Fri, 01 May 2015 17:52:11 GMT https://community.splunk.com/t5/Splunk-Search/Work-out-the-duration-between-two-fields/m-p/170480#M48776 fdi01 2015-05-01T17:52:11Z https://community.splunk.com/t5/Splunk-Search/Work-out-the-duration-between-two-fields/m-p/170481#M48777 <P>The first answer using "stats" (not using "transaction") will be more effective (the max_span, etc. values are infinite) and also MUCH more efficient (quicker to run).</P> Sat, 02 May 2015 01:37:05 GMT https://community.splunk.com/t5/Splunk-Search/Work-out-the-duration-between-two-fields/m-p/170481#M48777 woodcock 2015-05-02T01:37:05Z