https://community.splunk.com/t5/Splunk-Search/help-search/m-p/41830#M9687 <P>I'm bringing data from a database every 1 minuite.</P><P><BR /> Data is three kinds.</P><P><BR /> Data type is</P><P><BR /> 1. 2013-02-01 13:12:01;i;OS0001; ~~~<BR /> 2. 2013-02-01 13:12:04;d;OS0001; ~~~<BR /> 3. 2013-02-01 13:13:06;u;OS0001;~~~</P> <P>=&gt; "i" is insert, "d" is delete.</P><P> , "u" is update, OSC001 is PK.</P><P><BR /> Can you calculate in case "d" data comes "i" next time?</P> Mon, 25 Feb 2013 06:02:10 GMT khyoung7410 2013-02-25T06:02:10Z https://community.splunk.com/t5/Splunk-Search/help-search/m-p/41830#M9687 <P>I'm bringing data from a database every 1 minuite.</P><P><BR /> Data is three kinds.</P><P><BR /> Data type is</P><P><BR /> 1. 2013-02-01 13:12:01;i;OS0001; ~~~<BR /> 2. 2013-02-01 13:12:04;d;OS0001; ~~~<BR /> 3. 2013-02-01 13:13:06;u;OS0001;~~~</P> <P>=&gt; "i" is insert, "d" is delete.</P><P> , "u" is update, OSC001 is PK.</P><P><BR /> Can you calculate in case "d" data comes "i" next time?</P> Mon, 25 Feb 2013 06:02:10 GMT https://community.splunk.com/t5/Splunk-Search/help-search/m-p/41830#M9687 khyoung7410 2013-02-25T06:02:10Z https://community.splunk.com/t5/Splunk-Search/help-search/m-p/41831#M9688 <P>Streamstats is your friend for comparing events with their predecessor.</P> Mon, 25 Feb 2013 08:00:34 GMT https://community.splunk.com/t5/Splunk-Search/help-search/m-p/41831#M9688 martin_mueller 2013-02-25T08:00:34Z