I am trying to get a time difference of two events and using timechart, I wants to display MAX(time difference value ) in a span of 30seconds; Below query is working with table and I want to use timechart - Any help appreciated.
index=express_its_pds_solsup_dce sourcetype="express:dce:shipmentlog" "EWPX - WCO: Begin saving"
| rex field=_raw "build.(?<SHIP_FILE>[\S+]*)"
| stats latest(_time) as begin_time by SHIP_FILE
| join SHIP_FILE
[ search index=express_its_pds_solsup_dce sourcetype="express:dce:shipmentlog" "EWPX - WCO: End"
| rex field=_raw "build.(?<SHIP_FILE>[\S+]*)"
| stats latest(_time) as end_time by SHIP_FILE ] | eval ship_throughput = end_time-begin_time
| table SHIP_FILE, ship_throughput
streamstats is the best option to find out difference between two events. Below is the sample working query. you can tailor it as per your needs.
index=_internal sourcetype=splunkd host="samplehost" component=StatusMgr
| bin _time span=30s
| stats count by _time source
| streamstats range(_time) as delta window=2 global=f by source
| eventstats max(delta) as max_delta