How calculate the delta between the timestamp in one row with the timestamp in the previous row for all results?

[Brigno]

Hi,

In my search result, I have a series of events. I am able to calculate the delta of the various _time timestamps between each event, but how can I calculate the delta dividing the result in pairs? For example, I have 6 timestamps:

1 - 22/02/16 14:50:00.000
2 - 22/02/16 14:50:30.000
3 - 22/02/16 14:50:38.000
4 - 22/02/16 14:50:59.000
5 - 22/02/16 14:53:06.000
6 - 22/02/16 14:54:00.000
...

I need the delta between line 1 and line 2, then between line 3 and line 4, and so on for the entire result. Someone knows how to do something like this?

[woodcock]

Like this:

Your Base Search Here
| streamstats count AS serial
| eval copy_time=if(serial%2==1, _time, null())
| streamstats current=f last(copy_time) AS last_time
| eval delta = if(isnull(copy_time), tostring(last_time - _time, "duration"), null())

[Stevelim]

Have you considered the Delta command?

[your search] | delta _time as OnSince  | eval OnSince = tostring (OnSince, "duration")

[Brigno]

Yes, I do. I know it, but it's not what I'm looking for. That command make a delta between line 1-2, 2-3, 3-4. 4-5 and so on, but what I really need is a delta between lines 1-2, 3-4, 5-6 etc.