In my search result, I have a series of events. I am able to calculate the delta of the various _time timestamps between each event, but how can I calculate the delta dividing the result in pairs? For example, I have 6 timestamps:
1 - 22/02/16 14:50:00.000 2 - 22/02/16 14:50:30.000 3 - 22/02/16 14:50:38.000 4 - 22/02/16 14:50:59.000 5 - 22/02/16 14:53:06.000 6 - 22/02/16 14:54:00.000 ...
I need the delta between line 1 and line 2, then between line 3 and line 4, and so on for the entire result. Someone knows how to do something like this?
Your Base Search Here | streamstats count AS serial | eval copy_time=if(serial%2==1, _time, null()) | streamstats current=f last(copy_time) AS last_time | eval delta = if(isnull(copy_time), tostring(last_time - _time, "duration"), null())
Yes, I do. I know it, but it's not what I'm looking for. That command make a delta between line 1-2, 2-3, 3-4. 4-5 and so on, but what I really need is a delta between lines 1-2, 3-4, 5-6 etc.