Getting Data In

How calculate the delta between the timestamp in one row with the timestamp in the previous row for all results?

Brigno
New Member

Hi,

In my search result, I have a series of events. I am able to calculate the delta of the various _time timestamps between each event, but how can I calculate the delta dividing the result in pairs? For example, I have 6 timestamps:

1 - 22/02/16 14:50:00.000
2 - 22/02/16 14:50:30.000
3 - 22/02/16 14:50:38.000
4 - 22/02/16 14:50:59.000
5 - 22/02/16 14:53:06.000
6 - 22/02/16 14:54:00.000
...

I need the delta between line 1 and line 2, then between line 3 and line 4, and so on for the entire result. Someone knows how to do something like this?

0 Karma

woodcock
Esteemed Legend

Like this:

Your Base Search Here
| streamstats count AS serial
| eval copy_time=if(serial%2==1, _time, null())
| streamstats current=f last(copy_time) AS last_time
| eval delta = if(isnull(copy_time), tostring(last_time - _time, "duration"), null())
0 Karma

Stevelim
Communicator

Have you considered the Delta command?

[your search] | delta _time as OnSince  | eval OnSince = tostring (OnSince, "duration")
0 Karma

Brigno
New Member

Yes, I do. I know it, but it's not what I'm looking for. That command make a delta between line 1-2, 2-3, 3-4. 4-5 and so on, but what I really need is a delta between lines 1-2, 3-4, 5-6 etc.

0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...