To calculate difference of first event and last event in the log

[angalakuditived]

Hi ,

I have to calculate the time difference between first event and last event for a particular flow in log I have used earliest (_time) and latest(_time) which gave me correct data.

Index= * | stats earliest(_time) as Earliest and latest (_time) as Latest 

Gave output in epoch Times but I need difference of Earliest and Latest,tried using diff and eval diff to strf time but no luck.

Can someone help me with the query please

[ITWhisperer]

Doesn't this give you the difference (in seconds)?

| eval diff=Latest-Earliest