Using span option in timechart doesn't show any values

[4uramana4u]

I am trying to get a time difference of two events and using timechart, I wants to display MAX(time difference value ) in a span of 30seconds;  Below query is working with table and I want to use timechart - Any help appreciated. 

index=express_its_pds_solsup_dce sourcetype="express:dce:shipmentlog" "EWPX - WCO: Begin saving"
| rex field=_raw "build.(?<SHIP_FILE>[\S+]*)"
| stats latest(_time) as begin_time by SHIP_FILE
| join SHIP_FILE
[ search index=express_its_pds_solsup_dce sourcetype="express:dce:shipmentlog" "EWPX - WCO: End"
| rex field=_raw "build.(?<SHIP_FILE>[\S+]*)"
| stats latest(_time) as end_time by SHIP_FILE ] | eval ship_throughput = end_time-begin_time

| table SHIP_FILE, ship_throughput

[thambisetty]

@4uramana4u 

streamstats is the best option to find out difference between two events. Below is the sample working query. you can tailor it as per your needs.

index=_internal sourcetype=splunkd host="samplehost" component=StatusMgr 
| bin _time span=30s 
| stats count by  _time source
| streamstats range(_time) as delta window=2 global=f by source
| eventstats max(delta) as max_delta

[4uramana4u]

Thank you, solved.