https://community.splunk.com/t5/Splunk-Search/How-to-index-a-field-where-identical-values-have-different/m-p/335367#M99622 <P>Try this... </P> <PRE><CODE> | sort 0 _time ID fieldA | streamstats current=f last(_time) as priortime by ID fieldA | eval duration=coalesce(_time - priortime,"No prior") </CODE></PRE> Thu, 14 Sep 2017 16:53:10 GMT DalJeanis 2017-09-14T16:53:10Z https://community.splunk.com/t5/Splunk-Search/How-to-index-a-field-where-identical-values-have-different/m-p/335366#M99621 <P>How to index the same field "A" different values for the unique ID? A set of field "A" values is finite and for each ID can have multiple identical field values.</P> <P>After a few search strings I have a table. I try to explain by img:</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/3495i77C9B2A49C9378DA/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>My main difficulty that I can't calculate the time difference between any two points of the field "A", because there are the same field "A" values. I think that this way will help me.</P> Thu, 14 Sep 2017 16:03:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-index-a-field-where-identical-values-have-different/m-p/335366#M99621 AlexeyPy 2017-09-14T16:03:27Z https://community.splunk.com/t5/Splunk-Search/How-to-index-a-field-where-identical-values-have-different/m-p/335367#M99622 <P>Try this... </P> <PRE><CODE> | sort 0 _time ID fieldA | streamstats current=f last(_time) as priortime by ID fieldA | eval duration=coalesce(_time - priortime,"No prior") </CODE></PRE> Thu, 14 Sep 2017 16:53:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-index-a-field-where-identical-values-have-different/m-p/335367#M99622 DalJeanis 2017-09-14T16:53:10Z https://community.splunk.com/t5/Splunk-Search/How-to-index-a-field-where-identical-values-have-different/m-p/335368#M99623 <P>Hey @AlexeyPy, If DalJeanis solved your problem, please don't forget to accept an answer! You can upvote posts as well. (Karma points will be awarded for either action.) Happy Splunking!</P> Fri, 15 Sep 2017 01:32:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-index-a-field-where-identical-values-have-different/m-p/335368#M99623 lfedak_splunk 2017-09-15T01:32:04Z https://community.splunk.com/t5/Splunk-Search/How-to-index-a-field-where-identical-values-have-different/m-p/335369#M99624 <P>Unfortunately, that's not what I need. I need to be able to calculate the difference in time between those points, which I want. In this search only between the first and last in the group</P> Fri, 15 Sep 2017 08:22:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-index-a-field-where-identical-values-have-different/m-p/335369#M99624 AlexeyPy 2017-09-15T08:22:46Z